CVE-2010-4699: The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle...

Security readout for executives and security teams

This issue affects PHP’s Iconv extension before PHP 5.3.4 when decoding email headers with unknown character encodings. A malformed Subject header could produce incomplete decoding results, which may weaken spam detection or other email-processing decisions. The public record does not provide a CVSS score or confirmed exploitation. Exposure is most likely in legacy PHP applications or mail-processing systems running PHP before 5.3.4 and using iconv_mime_decode_headers for MIME header parsing, spam filtering, or security decisions. Modern supported PHP versions should not be assumed affected from the provided sources. Treat this as a legacy exposure check, not an emergency from the provided evidence. Prioritize if old PHP mail-processing systems remain in production, especially where email headers influence spam, routing, or security controls. Mitigation focus: Upgrade legacy PHP runtimes to PHP 5.3.4 or a vendor-supported patched build.; Review vendor package advisories for backported fixes in distribution PHP builds.; Do not rely solely on decoded Subject output for spam or security decisions..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.