CVE-2026-7259

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7259", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-04-28T05:07:03.118Z", "datePublished": "2026-05-10T04:13:26.766Z", "dateUpdated": "2026-05-11T13:13:50.416Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-05-10T04:13:26.766Z"}, "title": "Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "datePublic": "2026-05-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "type": "CWE"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "packageName": "mbstring", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to\u00a0\u00a0a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to\u00a0mb_regex_encoding().", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to&nbsp;&nbsp;a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to&nbsp;<code>mb_regex_encoding()</code>."}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber"}}], "credits": [{"lang": "en", "value": "Viet Hoang Luu (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Amirmohammad Pasdar (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Wachiraphan Charoenwet (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Shaanan Cohney (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Toby Murray (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Van-Thuan Pham (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Ilija Tovilo", "type": "remediation developer"}], "source": {"advisory": "GHSA-wm6j-2649-pv75", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T13:12:58.875843Z", "id": "CVE-2026-7259", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T13:13:50.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "source": {"advisory": "GHSA-wm6j-2649-pv75", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Viet Hoang Luu (The University of Melbourne)"}, {"lang": "en", "type": "reporter", "value": "Amirmohammad Pasdar (The University of Melbourne)"}, {"lang": "en", "type": "reporter", "value": "Wachiraphan Charoenwet (The University of Melbourne)"}, {"lang": "en", "type": "reporter", "value": "Shaanan Cohney (The University of Melbourne)"}, {"lang": "en", "type": "reporter", "value": "Toby Murray (The University of Melbourne)"}, {"lang": "en", "type": "reporter", "value": "Van-Thuan Pham (The University of Melbourne)"}, {"lang": "en", "type": "remediation developer", "value": "Ilija Tovilo"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver"}], "packageName": "mbstring", "defaultStatus": "affected"}], "datePublic": "2026-05-07T00:00:00.000Z", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to\u00a0\u00a0a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to\u00a0mb_regex_encoding().", "supportingMedia": [{"type": "text/html", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to&nbsp;&nbsp;a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to&nbsp;<code>mb_regex_encoding()</code>.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-05-10T04:13:26.766Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T13:12:58.875843Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-11T13:13:46.335Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-7259", "state": "PUBLISHED", "dateUpdated": "2026-05-10T04:13:26.766Z", "dateReserved": "2026-04-28T05:07:03.118Z", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "datePublished": "2026-05-10T04:13:26.766Z", "assignerShortName": "php"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageName": "mbstring", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.2.31", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.31", "status": "affected", "version": "8.3.*", "versionType": "semver"}, {"lessThan": "8.4.21", "status": "affected", "version": "8.4.*", "versionType": "semver"}, {"lessThan": "8.5.6", "status": "affected", "version": "8.5.*", "versionType": "semver"}]}], "source": "security@php.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "A892B6FF-F4EB-40C6-8DD0-D2246A71D271", "versionEndExcluding": "8.2.31", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DBBB51D-F0C4-4CEC-9B6B-33D0BF0044A5", "versionEndExcluding": "8.3.31", "versionStartIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA663C03-392C-41CC-BD11-4A1245203C42", "versionEndExcluding": "8.4.21", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "6101DA12-5AA1-4882-A52A-61FB74254F9A", "versionEndExcluding": "8.5.6", "versionStartIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to\u00a0\u00a0a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to\u00a0mb_regex_encoding()."}, {"lang": "es", "value": "En versiones de PHP 8.2.* anteriores a 8.2.31, 8.3.* anteriores a 8.3.31, 8.4.* anteriores a 8.4.21, y 8.5.* anteriores a 8.5.6, una falta de coincidencia entre las listas de codificaci\u00f3n en Oniguruma y mbfl conduce a una desreferencia de puntero NULL, lo que resulta en un fallo de segmentaci\u00f3n y denegaci\u00f3n de servicio. La vulnerabilidad es explotable cuando la entrada controlada por el usuario puede influir en la codificaci\u00f3n pasada a mb_regex_encoding()."}], "id": "CVE-2026-7259", "lastModified": "2026-07-24T08:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@php.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7259", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T13:12:58.875843Z", "version": "2.0.3"}}]}, "published": "2026-05-10T05:16:11.507", "references": [{"source": "security@php.net", "tags": ["Vendor Advisory"], "url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security@php.net", "type": "Secondary"}]}

{"bugzilla": {"description": "php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "id": "2468564", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468564"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in PHP. When an attacker input can influence the encoding passed to `mb_regex_encoding()` and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in the PHP process, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, implement an encoding validation mechanism to reject the specific encodings and aliases that cause the mismatch between Oniguruma and mbfl. The following encodings and aliases are known to trigger this issue: iso-8859-11 and ISO8859-11, UJIS (EUC-JP alias), GB-2312 (EUC-CN alias), KOI-8R (KOI8 alias), and US_ASCII or ISO646 (ASCII aliases)."}, "name": "CVE-2026-7259", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php8.4", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "php:7.4/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.3/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-05-10T04:13:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-7259\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-7259\nhttps://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75"], "statement": "To exploit this issue, an attacker needs to be able to influence the encoding passed to `mb_regex_encoding()` in a way that triggers a mismatch between the Oniguruma and mbfl encoding support. Also, the application must use the mbregex search APIs, allowing the attacker to cause a NULL pointer dereference. Due to these reasons, this flaw has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0,8.4.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0,8.5.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PHP", "source": "cna", "vendor": "PHP Group"}, "product": "php", "vendor": "php_group"}], "created": "2026-05-10T05:30:05.140526+00:00", "updated": "2026-05-10T06:00:05.872136+00:00", "vendors": ["php_group", "php_group$PRODUCT$php"]}