CVE-2026-6104: PHP mbstring Out-of-Bounds Read, Fix 8.4.21

CVE-2026-6104 is an out-of-bounds read (CVSS 9.1 in the record) in PHP mbstring. An encoding name with an embedded NUL byte can make functions like mb_convert_encoding read global memory. It affects PHP 8.4 before 8.4.21 and 8.5 before 8.5.6. Upgrade, and never pass user input as an encoding name.

What's affected

• PHP 8.4.x before 8.4.21. Fixed in 8.4.21.
• PHP 8.5.x before 8.5.6. Fixed in 8.5.6.
• Functions: mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), mb_detect_order(), and the mbstring.detect_order and mbstring.http_output INI settings.
• Weakness: CWE-125, out of bounds read. CVSS 9.1 (critical) in the record, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
• The PHP advisory rates it Moderate. The code compares names with strncasecmp() and assumes a zero result means the strings have equal length, which fails when the name holds a NUL byte.

How to check if you're exposed

Check the PHP version and whether mbstring is loaded.

php -v
php -m | grep -i mbstring

Run that on every web server, CLI host and container image. Then search your code for places where an encoding name could come from a request, since that is the realistic trigger:

grep -rn "mb_convert_encoding\|mb_detect_encoding\|mb_convert_variables" --include=*.php .

Distributions backport fixes, so also check your vendor's notice. Red Hat lists an erratum, RHSA-2026:22649, in the record.

What to do now

1. Find all PHP 8.4 and 8.5 installs and images.
2. Upgrade to 8.4.21 or 8.5.6, or to your distribution's patched package.
3. Validate any encoding name that comes from users against an allow list before it reaches mbstring functions.
4. Restart PHP-FPM or Apache after upgrading so running workers pick up the new build.

Why it matters

The bug sits in how PHP compares an encoding name against its list of known names. It trusts that a zero from a comparison means equal strings, and that breaks when the supplied name contains a NUL byte, so the code reads past the string into global memory. The result can be a crash or leaked data.

The record scores it 9.1, while the PHP advisory calls it Moderate. The gap is the usual one: the score assumes the worst reach, while real exposure depends on whether untrusted input ever names an encoding. Fix it either way. The record's KEV flag is false.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• PHP advisory GHSA-74r9-qxhc-fx53
• Red Hat entry for CVE-2026-6104 (listed in the record)

Last reviewed: 19 October 2026.