# CVE-2026-6104: PHP mbstring out-of-bounds read in mb_convert_encoding

Source: https://junglewise.ai/threats/cve-2026-6104-php-mbstring-out-of-bounds-read-in-mb-convert-encoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-6104 · Severity: critical · CVSS 9.1 · Published 2026-05-10

PHP, a widely used programming language for web development, contains a security flaw in its multibyte string handling component. An attacker can exploit this by providing specially crafted text encoding names to a website, potentially causing the site to crash or leak sensitive internal memory data. This could lead to service disruptions or the exposure of information that should remain private.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-6104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6104 being exploited in the wild.

**How severe is CVE-2026-6104?** Critical severity, with a CVSS score of 9.1, published 10 May 2026.

**Which products and versions are affected?** PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6; Red Hat Enterprise Linux AppStream 10.2.

**Is there a fix for CVE-2026-6104?** A patch was published on 2026-06-02: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6104 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6104?** Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in PHP's mbstring extension, specifically within the mbfl_name2encoding_ex() function. The root cause is an incorrect assumption that a zero return from strncasecmp() implies equal string lengths when a NUL byte is embedded in the input encoding name. An attacker can trigger this by passing a malicious encoding string to functions like mb_convert_encoding(), mb_detect_encoding(), or via certain INI settings. This results in a global buffer over-read, allowing for the disclosure of adjacent global memory or a process crash. The issue is resolved in PHP versions 8.4.21 and 8.5.6.

## Affected products

- PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2

## Timeline

- 2026-05-07: advisory: PHP Group published GHSA-74r9-qxhc-fx53
- 2026-05-10: disclosed: CVE-2026-6104 published
- 2026-06-02: patched: Red Hat released security updates for RHEL 10

## References

- [https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)
- [https://access.redhat.com/errata/RHSA-2026:22649](https://access.redhat.com/errata/RHSA-2026:22649)
- [https://access.redhat.com/security/cve/CVE-2026-6104](https://access.redhat.com/security/cve/CVE-2026-6104)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2468573](https://bugzilla.redhat.com/show_bug.cgi?id=2468573)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.json)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)