CVE-2026-92842

A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bounds read, leading to information disclosure by leaking sensitive heap memory contents into the output stream.

This vulnerability is rated as Moderate severity because exploitation requires an application to process untrusted input that controls specific stream filter configuration parameters, namely line-break character options containing null bytes. In standard Red Hat Enterprise Linux deployments, applications rarely expose filter instantiation parameters directly to unauthenticated external users. While an out-of-bounds read can leak adjacent memory data into the processed stream, it does not enable arbitrary code execution or system modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.