A security flaw exists in specific PHP versions (8.4.* older than 8.4.21 and 8.5.* older than 8.5.6) that impacts the mbstring extension, a tool used to handle text encoding conversions for websites. The issue is triggered when a specially crafted encoding name containing a hidden embedded NUL byte is passed to affected mbstring functions.
When this flaw is exploited, it can cause your website to crash, or in rare cases leak small amounts of unrelated server memory data. It impacts common text processing functions including mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output configuration settings that control how your site processes text encodings.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
