CVE-2026-92842

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters contain a memory handling issue. These filters use a line-break-chars option where the length is tracked independently of the actual string. The filter constructors use the pestrdup() function, which terminates the string at the first NUL byte but retains the original length. Consequently, when the filter generates a line break, it reads beyond the truncated memory allocation, resulting in the leakage of adjacent heap bytes into the filter output.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.