Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-6104 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring… https://www.cve.org/CVERecord?id=CVE-2026-6104
Post summary
The post references CVE-2026-6104, detailing affected PHP versions and the nature of the vulnerability, but provides no proof of concept, exploit, or patch information.
CVE-2026-6104 Out-of-Bounds Read in PHP mbstring Functions via NUL Byte Encoding https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6104
Post summary
The text briefly notes CVE-2026-6104 as an out‑of‑bounds read in PHP mbstring functions via NUL byte encoding, but provides no further details or actionable information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | php | php | - | - | - |