CVE-2026-6104

score

<0.1

cvss

9.1

epss

0.6%

published

2026-05-10

kev added

—

first seen

2026-10-21

PHP 8.4.* < 8.4.21 and 8.5.* < 8.5.6 contain an out-of-bounds read caused by incorrect handling of encoding names with embedded NUL bytes in mbstring functions, letting attackers cause crashes or information disclosure, exploit requires crafted encoding input.