CVE-2026-6104

A flaw was found in PHP. When an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, an out-of-bounds read of only 1 byte can occur due to the incorrect processing of string lengths. This issue can cause a denial of service or limited information disclosure.

This issue is exploited via a crafted encoding passed to mb_convert_encoding() without sanitization. The mb_detect_encoding(), mb_convert_variables() and mb_detect_order() functions, as well as the mbstring.detect_order and mbstring.http_output INI settings are also vulnerable. This vulnerability allows an attacker to cause an out-of-bounds read of only 1 byte, leading to a denial of service or a limited information disclosure. Due to these reasons, this flaw has been rated with an important severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, sanitize any input containing a NUL byte before calling the vulnerable mbstring functions. Also, verify your PHP configuration to ensure the vulnerable INI settings are using securely hardcoded encodings.