Security readout for executives and security teams
Plain-English summary
PHP mbstring can read beyond expected memory when given an encoding name containing an embedded NUL byte. For exposed applications, this could crash PHP processes or disclose limited memory. The issue is high priority where untrusted users can influence character encoding parameters.
Executive priority
Treat as a high-priority maintenance and exposure-reduction issue. Patch affected PHP 8.4 and 8.5 systems promptly, especially public services using mbstring with user-controlled encodings.
Technical view
CVE-2026-6104 is a CWE-125 global buffer over-read in PHP 8.4 before 8.4.21 and 8.5 before 8.5.6. mbstring incorrectly treats a zero strncasecmp() result as equal length, affecting mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), mb_detect_order(), and related INI settings.
Likely exposure
Exposure is most likely in PHP 8.4 or 8.5 applications using mbstring where request data, API input, headers, or configuration can influence encoding names.
Exploitation context
The bundle lists network, low-complexity, unauthenticated impact with no user interaction. KEV is false, and no provided source states active exploitation. Evidence supports crash and possible limited information disclosure, not integrity compromise.
Researcher notes
Focus triage on whether an attacker can introduce embedded NUL bytes into encoding names passed to affected mbstring APIs or settings. Do not assume all PHP applications are exposed solely because mbstring is installed.
Mitigation direction
- Upgrade PHP 8.4 deployments to 8.4.21 or later.
- Upgrade PHP 8.5 deployments to 8.5.6 or later.
- Apply relevant vendor or distribution errata, including Red Hat advisories where applicable.
- Restrict accepted encoding names to a fixed approved list.
- Check PHP Group and platform vendor guidance before adding compensating controls.
Validation and detection
- Inventory systems running PHP 8.4 or 8.5 with mbstring enabled.
- Review code for affected mbstring functions accepting variable encoding names.
- Check configuration using mbstring.detect_order or mbstring.http_output.
- Confirm installed PHP versions include the fixed vendor build.
- Prioritize internet-facing services and APIs handling user-supplied encodings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-6104 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H3.94.2redhat-SADPCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber——phpVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-10T06:01:02.802Z: Reported to Red Hat.
- 2026-05-10T04:35:17.328Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53CVE reference, php · vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-6104CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2468573CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22649CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.