Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-7259

Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.2.* to < 8.2.31affected
  • 8.3.* to < 8.3.31affected
  • 8.4.* to < 8.4.21affected
  • 8.5.* to < 8.5.6affected

References