CVE-2026-6104

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6104
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6104.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6104
Aliases
Downstream
ALPINE (1)
ALSA (1)
BELL (1)
DEBIAN (1)
MINI (2)
openSUSE (2)
RHSA (1)
RLSA (1)
SUSE (1)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (1)
Published
2026-05-10T04:35:17Z
Modified
2026-11-11T02:55:53Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber CVSS Calculator
Summary
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Details

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6104.json"
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
b437f2b32eb364c9496d24abcc734272e5c9c980
Fixed
7a64ae0507799547fbbd39b067bd3dd2c35e8fec
Introduced
685e99655ae97c667950f7f7d176985958718f56
Fixed
fcc29c8d6d6ee6f5ba2d941f0a2a6ea6aa6ee633
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.4.0"
                },
                {
                    "fixed": "8.4.21"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.6"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6104.json"