Name: CVE-2026-6104: Out-of-bounds Read
Creator: Rapid7
Published: 2026-05-10T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-6104, CWE-125, CVSS 9.1, EPSS 0.00021

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

CVSS Details

CVSS 4.0 Base Score: 6.3 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Amber)
CVSS 3.1 Base Score: 9.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade php85Upgrade php84	May 15, 2026	May 10, 2026
Amazon_linux_2023	—	Upgrade php8.4-fpmUpgrade php8.4-mbstringUpgrade php8.4-tidy-debuginfoUpgrade php8.4-pdoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.4-sodium-debuginfoUpgrade php8.4-sodiumUpgrade php8.4-common-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-embeddedUpgrade php8.4-ffiUpgrade php8.4-zip-debuginfoUpgrade php8.4-modphpUpgrade php8.4-pgsqlUpgrade php8.4-cliUpgrade php8.4-odbcUpgrade php8.4-opcache-debuginfoUpgrade php8.4Upgrade php8.4-tidyUpgrade php8.4-mysqlndUpgrade php8.4-opcacheUpgrade php8.4-gmpUpgrade php8.4-soapUpgrade php8.4-gdUpgrade php8.4-snmp-debuginfoUpgrade php8.4-modphp-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-develUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-xmlUpgrade php8.4-bcmathUpgrade php8.4-processUpgrade php8.4-intlUpgrade php8.4-gd-debuginfoUpgrade php8.4-debuginfoUpgrade php8.4-zipUpgrade php8.4-commonUpgrade php8.4-pdo-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-dbgUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.4-enchantUpgrade php8.4-dbg-debuginfoUpgrade php8.4-debugsourceUpgrade php8.4-xml-debuginfoUpgrade php8.4-ldapUpgrade php8.4-snmpUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-dba-debuginfoUpgrade php8.4-dba	May 28, 2026	May 10, 2026
Debian	—	Upgrade php8.4	Jul 23, 2026	Jul 23, 2026
Oracle_linux	—	Upgrade php8.4-pgsqlUpgrade php8.4-mysqlndUpgrade php8.4-enchantUpgrade php8.4-embeddedUpgrade php8.4-intlUpgrade php8.4-fpmUpgrade php8.4-develUpgrade php8.4-xmlUpgrade php8.4-pdoUpgrade php8.4-processUpgrade php8.4Upgrade php8.4-soapUpgrade php8.4-opcacheUpgrade php8.4-cliUpgrade php8.4-ffiUpgrade php8.4-dbgUpgrade php8.4-commonUpgrade php8.4-bcmath	Oct 22, 2026	May 10, 2026
Redhat_linux	—	Upgrade php8.4-odbcUpgrade php8.4-soapUpgrade php8.4Upgrade php8.4-gd-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-commonUpgrade php8.4-opcacheUpgrade php8.4-common-debuginfoUpgrade php8.4-mysqlndUpgrade php8.4-debugsourceUpgrade php8.4-dba-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-processUpgrade php8.4-pdo-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-pdoUpgrade php8.4-dbg-debuginfoUpgrade php8.4-bcmathUpgrade php8.4-intlUpgrade php8.4-process-debuginfoUpgrade php8.4-fpmUpgrade php8.4-dbgUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-cliUpgrade php8.4-develUpgrade php8.4-ffiUpgrade php8.4-gmpUpgrade php8.4-gdUpgrade php8.4-fpm-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.4-snmpUpgrade php8.4-soap-debuginfoUpgrade php8.4-dbaUpgrade php8.4-xmlUpgrade php8.4-embedded-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.4-enchantUpgrade php8.4-ldapUpgrade php8.4-ldap-debuginfoUpgrade php8.4-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-mbstringUpgrade php8.4-embeddedUpgrade php8.4-cli-debuginfo	Jun 4, 2026	May 10, 2026
Rocky_linux	—	Upgrade php8.4-mbstringUpgrade php8.4Upgrade php8.4-enchant-debuginfoUpgrade php8.4-embeddedUpgrade php8.4-dbg-debuginfoUpgrade php8.4-intlUpgrade php8.4-pdoUpgrade php8.4-debugsourceUpgrade php8.4-opcacheUpgrade php8.4-odbcUpgrade php8.4-pgsqlUpgrade php8.4-cliUpgrade php8.4-fpm-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-develUpgrade php8.4-embedded-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php8.4-ffiUpgrade php8.4-mysqlndUpgrade php8.4-odbc-debuginfoUpgrade php8.4-xmlUpgrade php8.4-fpmUpgrade php8.4-bcmathUpgrade php8.4-gmp-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-debuginfoUpgrade php8.4-commonUpgrade php8.4-soap-debuginfoUpgrade php8.4-dbgUpgrade php8.4-snmpUpgrade php8.4-processUpgrade php8.4-gmpUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-gdUpgrade php8.4-soapUpgrade php8.4-ldapUpgrade php8.4-enchantUpgrade php8.4-cli-debuginfoUpgrade php8.4-dbaUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php8.4-dba-debuginfo	Jun 8, 2026	Jun 5, 2026
Ubuntu	—	Upgrade php8.1Upgrade php8.5Upgrade php8.4Upgrade php8.3	May 28, 2026	May 28, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence