CVE-2026-92842 in PHP
Summary
by MITRE • 09/25/2026
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability described involves a critical memory safety flaw within PHP's stream filter implementation, specifically affecting the base64 encoding, quoted-printable encoding, and quoted-printable decoding filters. This issue stems from an inconsistency in how string lengths are managed during object construction versus runtime execution. When these specific stream filters are initialized with a line-break-chars option, the system utilizes the pestrdup function to duplicate this configuration value for internal use. The fundamental technical flaw lies in the behavior of pestrdup, which is designed to create null-terminated copies of strings; consequently, it truncates the duplicated string at the first NUL byte encountered. However, the filter constructor retains and stores the original length of the input option rather than the truncated length of the newly allocated buffer. This discrepancy creates a dangerous state where the internal metadata claims ownership of more memory bytes than were actually allocated by the duplication process.
During operational execution, when the stream filter processes data that requires emitting line breaks according to its configuration, it attempts to copy the recorded line-break characters into the output stream. Because the system relies on the original, untruncated length value stored during initialization, it performs a memory read operation that extends beyond the bounds of the allocated buffer for the duplicated string. This out-of-bounds read results in the inclusion of adjacent heap bytes into the filter's output data. While this primarily manifests as an information disclosure vulnerability where sensitive internal memory contents may be leaked to the application or end-user, it also represents a significant stability risk depending on the surrounding memory layout and access permissions. Such behavior can potentially lead to crashes if the accessed memory is unmapped or protected, thereby contributing to denial-of-service conditions in addition to data leakage.
From a classification perspective, this vulnerability aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end of a buffer. It also relates closely to CWE-680 regarding integer overflows or incorrect calculations that lead to memory corruption issues, although in this specific case, it is more accurately described as an off-by-one or length mismatch error leading to heap-based out-of-bounds access. In terms of attack vectors and tactical behavior within the MITRE ATT&CK framework, this flaw facilitates Information Discovery through Data from Memory, allowing attackers to potentially extract sensitive information such as cryptographic keys, session tokens, or other confidential data stored in adjacent memory locations if they can control the input parameters triggering the line-break emission logic.
Mitigation strategies for this vulnerability require immediate patching of the affected PHP versions by developers who maintain the core source code. The fix involves ensuring that the length variable used during runtime operations matches the actual size of the duplicated string buffer, typically by using strlen on the result of pestrdup or explicitly passing the correct truncated length to subsequent functions. For system administrators and application owners unable to immediately patch their environments, mitigating this risk requires strict input validation and sanitization of any user-supplied data passed as line-break characters in stream filter configurations. Limiting the complexity and content of such inputs can reduce the likelihood of triggering the specific code paths that expose adjacent heap memory. Additionally, deploying runtime application self-protection tools or web application firewalls may help detect anomalous output patterns resulting from these out-of-bounds reads, although direct patching remains the only definitive remediation for this underlying logic error in the PHP engine.