CVE-2026-6104: php_group php Out-of-bounds Read

Vulnerability summary

CVE-2026-6104 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in php_group php. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.

Timeline

1. 10-05-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.