CVE-2026-92842

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its stream filters transform data as it is read or written; the convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode filters accept a line-break-chars option that sets the line break they insert.

An Out-of-Bounds Read vulnerability (CVE-2026-92842) has been identified in PHP's convert.* stream filters, which allows an attacker who can influence the line-break-chars option passed to these filters to make PHP read past the end of a heap allocation and place the adjacent heap bytes in the filter output, disclosing memory contents. PHP tracks this issue as GHSA-88hq-2827-7pg6.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 8.2.34, PHP 8.3 before 8.3.35, PHP 8.4 before 8.4.26 and PHP 8.5 before 8.5.11, which includes every release of the End-of-Life PHP 5.6, 7.0 through 7.4, 8.0 and 8.1 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <8.2.34, >=8.3.0 <8.3.35, >=8.4.0 <8.4.26, >=8.5.0 <8.5.11
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the standard extension of all versions of PHP before 8.2.34, PHP 8.3 before 8.3.35, PHP 8.4 before 8.4.26 and PHP 8.5 before 8.5.11, including the End-of-Life PHP 5.6, 7.0 through 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 5.9 under CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

The filter constructors store the line-break-chars value together with its length, which is tracked separately from the string itself. They copy the value with pestrdup(), which stops at the first NUL byte, but keep the original length. In PHP 7.4.33 the base64 encoder's constructor reads:

if (lbchars != NULL) {
    inst->lbchars = (lbchars_dup ? pestrdup(lbchars, persistent) : lbchars);
    inst->lbchars_len = lbchars_len;
} else {
    inst->lbchars = NULL;
} 

If the option contains a NUL byte, the copy is shorter than lbchars_len. Each time the filter emits a line break it copies lbchars_len bytes from that copy into its output:

memcpy(pd, inst->lbchars, inst->lbchars_len);
pd += inst->lbchars_len;
ocnt -= inst->lbchars_len; 

The copy reads past the end of the truncated allocation, and the adjacent heap bytes end up in the encoded or decoded output. The quoted-printable encoder and decoder have the same flaw. Exploitation needs an application that passes an attacker-influenced line-break-chars value to one of these filters, for example through stream_filter_append(), and returns the filtered output to the attacker. Any SAPI is affected, and the code is part of the always-built standard extension.

The fix copies the option with pestrndup() and its full length, so the stored copy always matches lbchars_len. NES for PHP carries the fix to PHP 5.6, 7.2 and 7.4.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not pass untrusted values as the line-break-chars option of the convert.* filters, or reject values that contain a NUL byte.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• geeknik (finder, remediation)
• Nora Dossche (remediation)