CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
A null pointer dereference in PHP's mb_ereg_search_init function allows attackers to cause a denial of service via crafted encoding inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-7259?
CVE-2026-7259 is a low-severity vulnerability in Php Php, published on 10 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
Weakness: CWE-476
Which versions are affected by CVE-2026-7259?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.2.0 | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
php Bitnami | From 8.2.0 | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
php-min Bitnami | From 8.2.0 | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
Products include Php Php.
How do I fix CVE-2026-7259?
Upgrade libphp to a fixed version for your release line: 8.2.31, 8.3.31, 8.4.21 or 8.5.6.
Is CVE-2026-7259 being exploited?
There is no known exploitation of CVE-2026-7259 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as AZL-86364, BELL-CVE-2026-7259, BIT-libphp-2026-7259, BIT-php-2026-7259, BIT-php-min-2026-7259, DEBIAN-CVE-2026-7259 and 6 more.