A security flaw has been identified in specific PHP versions (8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6), the core software that powers many dynamic websites. The issue affects common built-in functions used to handle text and character encoding for different languages and formats, including mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), mb_detect_order(), and related mbstring configuration settings.
The flaw is triggered when a specially crafted encoding name containing a hidden NUL byte is passed to these functions. Due to a coding error in how the software processes these inputs, this can cause the system to read memory outside its allowed boundaries. This may lead to unexpected website crashes, or in some cases, disclose small amounts of sensitive server data.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
