CVE-2026-7258: Out-of-bounds read in urldecode() on NetBSD
Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
Other sources
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7258?
CVE-2026-7258 has a medium severity level due to its potential to cause information disclosure through out-of-bounds read vulnerabilities.
How do I fix CVE-2026-7258?
To fix CVE-2026-7258, upgrade to PHP version 8.5.6 or later.
Which versions of PHP are affected by CVE-2026-7258?
CVE-2026-7258 affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
What functions are impacted by CVE-2026-7258?
CVE-2026-7258 specifically impacts functions such as urldecode() due to the improper handling of signed char data.
Is CVE-2026-7258 fixed in the latest PHP version?
Yes, CVE-2026-7258 is fixed in PHP version 8.5.6 and subsequent releases.