Bug 2468573 (CVE-2026-6104) - CVE-2026-6104 php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Summary: CVE-2026-6104 php: global buffer over-read in mb_convert_encoding() with atta...
Keywords:
Status: NEW
Alias: CVE-2026-6104
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-10 06:01 UTC by OSIDB Bzimport
Modified: 2026-06-02 22:08 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:22649 0 None None None 2026-06-02 22:08:01 UTC

Description OSIDB Bzimport 2026-05-10 06:01:25 UTC
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

Comment 3 errata-xmlrpc 2026-06-02 22:08:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:22649 https://access.redhat.com/errata/RHSA-2026:22649


Note You need to log in before you can comment on or make changes to this bug.