CVE-2026-7258

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its string and URL functions, such as urldecode(), quoted_printable_decode(), version_compare() and html_entity_decode(), are used on untrusted input in almost every PHP application.

An Out-of-Bounds Read vulnerability (CVE-2026-7258) has been identified in PHP, which allows an attacker who can pass bytes of 0x80 or above to functions such as urldecode() to make PHP read memory before the start of the C library's character classification tables, on platforms where those tables do not accept negative values, such as NetBSD. PHP tracks this issue as GHSA-m8rr-4c36-8gq4.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, which includes the End-of-Life release lines PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 through their final releases.

Details

Module Info

• Product: PHP
• Affected packages: php-src (Zend, main, ext/standard and other extensions)
• Affected versions: <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in PHP before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21 and 8.5 before 8.5.6, including the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L) and classifies it as CWE-125, Out-of-bounds Read.

The C standard says the argument to the ctype.h functions (isxdigit(), isdigit(), isalpha(), tolower() and the rest) must be EOF or a value representable as an unsigned char. Many call sites across the Zend engine, main and the bundled extensions passed a plain char instead. On platforms where char is signed, a byte of 0x80 or above becomes a negative number. In PHP 7.4.33, php_url_decode(), which implements urldecode(), checks for an escape sequence like this:

else if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1))
         && isxdigit((int) *(data + 2))) { 

Casting the char to int keeps the negative value. C libraries that implement these functions as a lookup in a table indexed by the argument, and whose table does not cover negative values, then read before the start of that table. The CVE record names NetBSD as such a system and states that this can trigger a denial of service. Other affected functions include quoted_printable_decode(), version_compare(), sscanf(), html_entity_decode() and sprintf().

Exploitation needs an attacker who can send bytes of 0x80 or above to one of the affected functions, which is easy for urldecode(), and a PHP build linked against a C library whose ctype tables do not handle negative values. HeroDevs' analysis confirms that the affected calls are present in PHP 5.6, 7.2 and 7.4 and are reachable from any server API. glibc accepts values from -128 to 255, so PHP builds on glibc-based Linux systems do not read out of bounds; for them the fix is hardening.

The fix casts the argument to unsigned char at the ctype.h call sites, so every byte is passed as a value from 0 to 255.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, run PHP on a C library whose ctype functions accept negative values, such as glibc.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• xfourj (finder)
• Ilija Tovilo (remediation)