CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Fixed (Out-of-bounds access in mbflname2encodingex()). (CVE-2026-6104)
Other sources
In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mbconvertencoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mbconvertencoding(), mbdetectencoding(), mbconvertvariables(), and mbdetectorder(), as well as the mbstring.detectorder and mbstring.httpoutput INI settings.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.31-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.21-1~deb13u1Fixed in 8.4.21-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6104?
CVE-2026-6104 has a high severity rating due to the potential for an attacker to exploit a global buffer over-read.
How do I fix CVE-2026-6104?
To fix CVE-2026-6104, upgrade PHP to version 8.4.21 or 8.5.6 or later.
What versions of PHP are affected by CVE-2026-6104?
CVE-2026-6104 affects PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6.
What is the impact of exploiting CVE-2026-6104?
Exploiting CVE-2026-6104 can lead to an out-of-bounds memory access, potentially resulting in information disclosure.
Is there a recommended workaround for CVE-2026-6104?
There is no specific workaround for CVE-2026-6104 other than upgrading to a patched version of PHP.