[ CVE-2026-92842 · Published 25 Sep 2026 ]
Vulnerability in PHP Group PHP
[ Description ]Official description
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-3585
PHP: Multiple vulnerabilities Translated from German
-
CERT-FRCERTFR-2026-AVI-1227
Multiple vulnerabilities in PHP Translated from French
Multiple vulnerabilities have been discovered in PHP. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.