CVE-2026-92842: PHP stream filter heap information leak with NUL bytes in line-break-chars

CVE-2026-92842 · Severity: medium · CVSS 5.9 · Published 2026-09-25

PHP's stream filter functions for base64 and quoted-printable encoding contain a memory safety bug that can leak heap data when the line-break-chars option contains embedded NUL bytes. An attacker who can control the option value in an application—such as through URL parameters—can read adjacent memory contents if the application returns the encoded output. The vulnerability requires unusual conditions and is marked moderate severity, but can disclose sensitive information from the server's memory.

Technologies: Php. Vendors: PHP.

Quick answers

Is CVE-2026-92842 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92842 being exploited in the wild.
How severe is CVE-2026-92842?
Medium severity, with a CVSS score of 5.9, published 25 September 2026.
Which products and versions are affected?
Php before 8.2.34, before 8.3.35, before 8.4.26, before 8.5.11.
Is there a fix for CVE-2026-92842?
A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92842 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-92842?
Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters track the line-break-chars option length separately from the string allocation. The constructors use pestrdup() which stops at the first NUL byte, but retain the original length value. When the filter inserts line breaks, it copies the recorded length from a truncated heap allocation, reading out-of-bounds and exposing adjacent heap bytes in the filter output. The fix uses pestrndup() to ensure the allocation always matches the recorded length. Exploitation requires the application to pass attacker-controlled bytes as the line-break-chars option and include an embedded NUL.

Affected products

  • PHP PHP before 8.2.34, before 8.3.35, before 8.4.26, before 8.5.11

Timeline

  • 2026-09-25: disclosed
  • 2026-09-25: patched: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.