CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
Fixed (Null pointer dereference in phpmbcheckencoding() via mberegsearchinit()). (CVE-2026-7259)
Other sources
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mbregexencoding().
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.31-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.21-1~deb13u1Fixed in 8.4.21-1 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.5.6 - Compensating control
Mitigate the vulnerability by ensuring user-controlled input cannot influence the encoding passed to mb_regex_encoding().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7259?
CVE-2026-7259 is classified as a critical vulnerability due to the potential for denial of service caused by null pointer dereference.
How do I fix CVE-2026-7259?
To fix CVE-2026-7259, upgrade to PHP versions 8.5.6 or later, ensuring your system is updated promptly.
Which versions of PHP are affected by CVE-2026-7259?
CVE-2026-7259 affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
What is the impact of CVE-2026-7259 on applications?
The impact of CVE-2026-7259 includes potential application crashes or denial of service due to the null pointer dereference issue.
Is there a workaround for CVE-2026-7259?
There is no known workaround for CVE-2026-7259; the recommended action is to upgrade to the fixed version.