CVEvulnerability

CVE-2026-92842

5.9 MEDIUM Published 2026-09-25 Modified 2026-10-27 Official page ↗
Status
Analyzed
Published
2026-09-25
Last modified
2026-10-27
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-122, CWE-125

Description

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.

Affected configurations

• php php (>= 8.2.0 < 8.2.34) • php php (>= 8.3.0 < 8.3.35) • php php (>= 8.4.0 < 8.4.26) • php php (>= 8.5.0 < 8.5.11)

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-125 Out-of-bounds Read weakness

References