Heap Vulnerability in PHP's Encoding Stream Filters

CVE-2026-92842

What is CVE-2026-92842?

A vulnerability in PHP's convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters can lead to a heap overflow. This occurs when the filters accept a line-break-chars option, whose length is inaccurately tracked, resulting in potential reading of adjacent heap bytes. When these filters emit line breaks, they may inadvertently copy lengths from truncated allocations, posing risks for data integrity and security.

References