Out-of-bounds Read Vulnerability in PHP mbstring Functions

CVE-2026-6104

What is CVE-2026-6104?

A vulnerability exists in specific PHP versions where the mb_convert_encoding() and related mbstring functions do not handle encoding names with embedded NUL bytes correctly. This flaw can lead to unintended out-of-bounds reads of global memory, which may result in application crashes or disclosure of sensitive information. Functions affected include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order, along with associated INI settings for mbstring detection and output.

References