CVE-2026-7259 - Vulnerability Details - OpenCVE

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Php Group	Php

No data.

No data.

References

Link	Providers
https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75

History

Sun, 10 May 2026 06:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Php Group Php Group php
Vendors & Products		Php Group Php Group php

Sun, 10 May 2026 04:45:00 +0000

Type	Values Removed	Values Added
Description		In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
Title		Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
Weaknesses		CWE-476
References		https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: php

Published: 2026-05-10T04:13:26.766Z

Updated: 2026-05-10T04:13:26.766Z

Reserved: 2026-04-28T05:07:03.118Z

Link: CVE-2026-7259

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-05-10T05:16:11.507

Modified: 2026-05-10T05:16:11.507

Link: CVE-2026-7259

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7259", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-04-28T05:07:03.118Z", "datePublished": "2026-05-10T04:13:26.766Z", "dateUpdated": "2026-05-10T04:13:26.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-05-10T04:13:26.766Z"}, "title": "Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "datePublic": "2026-05-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "type": "CWE"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "packageName": "mbstring", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to\u00a0\u00a0a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to\u00a0mb_regex_encoding().", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to <code>mb_regex_encoding()</code>."}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber"}}], "credits": [{"lang": "en", "value": "Viet Hoang Luu (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Amirmohammad Pasdar (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Wachiraphan Charoenwet (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Shaanan Cohney (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Toby Murray (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Van-Thuan Pham (The University of Melbourne)", "type": "reporter"}, {"lang": "en", "value": "Ilija Tovilo", "type": "remediation developer"}], "source": {"advisory": "GHSA-wm6j-2649-pv75", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to\u00a0\u00a0a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to\u00a0mb_regex_encoding()."}], "id": "CVE-2026-7259", "lastModified": "2026-05-10T05:16:11.507", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@php.net", "type": "Secondary"}]}, "published": "2026-05-10T05:16:11.507", "references": [{"source": "security@php.net", "url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security@php.net", "type": "Secondary"}]}