CVE-2026-92842: php_group php Heap-based Buffer Overflow

Vulnerability summary

CVE-2026-92842 is a medium (CVSS 5.9) Heap-based Buffer Overflow vulnerability in php_group php. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.9% of scored vulnerabilities.

Timeline

1. 25-09-2026
   PublishedVulnerability first disclosed.
2. 28-09-2026
   Last modifiedVulnerability information updated.

Description

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.