CVE-2026-7259

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - security@php.net

Published

2026-05-10

Last modified

2026-05-11

Weaknesses

CWE-476

Affected products

• Php (Php)
• Php (Php Group)

References

• https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75