Executive brief
PHP, a widely used programming language for web development, contains a security flaw in its multibyte string handling component. An attacker can exploit this by providing specially crafted text encoding names to a website, potentially causing the site to crash or leak sensitive internal memory data. This could lead to service disruptions or the exposure of information that should remain private.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in PHP's mbstring extension, specifically within the mbfl_name2encoding_ex() function. The root cause is an incorrect assumption that a zero return from strncasecmp() implies equal string lengths when a NUL byte is embedded in the input encoding name. An attacker can trigger this by passing a malicious encoding string to functions like mb_convert_encoding(), mb_detect_encoding(), or via certain INI settings. This results in a global buffer over-read, allowing for the disclosure of adjacent global memory or a process crash. The issue is resolved in PHP versions 8.4.21 and 8.5.6.
Affected products
- PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2
Timeline
- 2026-05-07: advisory: PHP Group published GHSA-74r9-qxhc-fx53
- 2026-05-10: disclosed: CVE-2026-6104 published
- 2026-06-02: patched: Red Hat released security updates for RHEL 10