CVE-2026-6104 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
An attacker can trigger an out-of-bounds read in PHP's mbstring functions via crafted encoding names, potentially disclosing memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6104?
CVE-2026-6104 is a medium-severity vulnerability in Php Php, published on 10 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
Weakness: CWE-125
Which versions are affected by CVE-2026-6104?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.4.0 | 8.4.21, 8.5.6 |
php Bitnami | From 8.4.0 | 8.4.21, 8.5.6 |
php-min Bitnami | From 8.4.0 | 8.4.21, 8.5.6 |
Products include Php Php.
How do I fix CVE-2026-6104?
Upgrade libphp to a fixed version for your release line: 8.4.21 or 8.5.6.
Is CVE-2026-6104 being exploited?
There is no known exploitation of CVE-2026-6104 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as BIT-libphp-2026-6104, BIT-php-2026-6104, BIT-php-min-2026-6104, DEBIAN-CVE-2026-6104, MINI-c599-q2v6-h6vp, MINI-fj8c-8w53-hcjg and 1 more.