CVE-2026-7259

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its mbstring extension provides multibyte string functions, including regular expression functions such as mb_ereg_search_init() that are built on the Oniguruma library.

A Denial of Service (DoS) vulnerability (CVE-2026-7259) has been identified in the regular expression functions of PHP's mbstring extension, which allows an attacker who can influence the encoding passed to mb_regex_encoding() to crash the PHP process through a NULL pointer dereference. PHP tracks this issue as GHSA-wm6j-2649-pv75.

Per MITRE CWE-476: The product dereferences a pointer that it expects to be valid but is NULL.

This issue affects all versions of PHP from 8.0.0 before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/mbstring)
• Affected versions: >=8.0.0 <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 8.0.1 (based on PHP 8.0.30)

Vulnerability Info

This Low-severity vulnerability is found in the mbstring extension of all PHP versions from 8.0.0 before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, including the End-of-Life PHP 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 2.1 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber).

mb_regex_encoding() sets the encoding used by the mbregex functions. php_mb_regex_set_mbctype() accepts any encoding that Oniguruma knows, then looks up the matching mbstring (mbfl) encoding and stores the result without checking it. Some encodings, such as iso-8859-11, are known to Oniguruma but not to mbfl, so the stored mbfl encoding is NULL. In PHP 8.0.30 the code reads:

int php_mb_regex_set_mbctype(const char *encname)
{
    OnigEncoding mbctype = _php_mb_regex_name2mbctype(encname);
    if (mbctype == ONIG_ENCODING_UNDEF) {
        return FAILURE;
    }
    MBREX(current_mbctype) = mbctype;
    MBREX(current_mbctype_mbfl_encoding) = mbfl_name2encoding(encname);
    return SUCCESS;

mb_ereg_search_init() later passes that NULL encoding to php_mb_check_encoding(), which dereferences it and crashes the process with a segmentation fault. In PHP 8.0.30, other mbregex functions such as mb_ereg() and mb_split() pass the same value to php_mb_check_encoding() and may reach the same crash.

Exposure requires an application that lets user input influence the encoding passed to mb_regex_encoding() and then calls an mbregex search function. Applications that set a fixed encoding, or that do not use the mbregex functions, are not affected. PHP 7.4 and earlier store the encoding differently and are not affected.

The fix makes php_mb_regex_set_mbctype() fail when mbfl has no matching encoding, so mb_regex_encoding() rejects it. In PHP 8.2.31 the check reads:

    const mbfl_encoding *mbfl_enc = mbfl_name2encoding(encname);
    if (mbfl_enc == NULL) {
        /* Encoding supported by Oniguruma but not by mbfl */
        return FAILURE;
    }
    MBREX(current_mbctype) = mbctype;
    MBREX(current_mbctype_mbfl_encoding) = mbfl_enc;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not pass user-controlled values to mb_regex_encoding(); use a fixed encoding or an allowlist.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Viet Hoang Luu (finder)
• Amirmohammad Pasdar (finder)
• Wachiraphan Charoenwet (finder)
• Shaanan Cohney (finder)
• Toby Murray (finder)
• Van-Thuan Pham (finder)
• Ilija Tovilo (remediation)