CVE-2026-7259

A flaw was found in PHP. When an attacker input can influence the encoding passed to mb_regex_encoding() and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in the PHP process, resulting in a denial of service.

To exploit this issue, an attacker needs to be able to influence the encoding passed to mb_regex_encoding() in a way that triggers a mismatch between the Oniguruma and mbfl encoding support. Also, the application must use the mbregex search APIs, allowing the attacker to cause a NULL pointer dereference. Due to these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, implement an encoding validation mechanism to reject the specific encodings and aliases that cause the mismatch between Oniguruma and mbfl. The following encodings and aliases are known to trigger this issue: iso-8859-11 and ISO8859-11, UJIS (EUC-JP alias), GB-2312 (EUC-CN alias), KOI-8R (KOI8 alias), and US_ASCII or ISO646 (ASCII aliases).