CVE-2026-6104 Details

A global buffer over-read vulnerability has been identified in PHP versions 8.4.* prior to 8.4.21 and 8.5.* prior to 8.5.6. The issue arises in the mbstring extension when encoding names containing embedded NUL bytes are passed to mb_convert_encoding() or related functions. The vulnerability occurs because the code incorrectly assumes that a return value of 0 from strncasecmp() indicates that the strings are of the same length. This misinterpretation can lead to an out-of-bounds read of global memory, potentially causing a crash or unauthorized information disclosure. The affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

Users can upgrade to PHP versions 8.4.21 or 8.5.6, where this vulnerability has been patched.