{"api_version":"1","generated_at":"2026-11-10T18:11:32+00:00","cve":"CVE-2026-92842","urls":{"html":"https://cve.report/CVE-2026-92842","api":"https://cve.report/api/cve/CVE-2026-92842.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-92842","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842"},"summary":{"title":"OOB read / info leak in convert.* stream filters when line-break-chars contains NUL","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.","state":"PUBLISHED","assigner":"php","published_at":"2026-09-25 22:18:49","updated_at":"2026-10-27 15:33:55"},"problem_types":["CWE-122","CWE-125","CWE-122 CWE-122 Heap-based buffer overflow","CWE-125 CWE-125 Out-of-bounds read"],"metrics":[{"version":"3.1","source":"security@php.net","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6","name":"https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6","refsource":"security@php.net","tags":["Vendor Advisory","Exploit"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92842","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.2.* 8.2.34 semver","platforms":[]},{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.3.* 8.3.35 semver","platforms":[]},{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.4.* 8.4.26 semver","platforms":[]},{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.5.* 8.5.11 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"@geeknik (GitHub)","lang":"en"},{"source":"CNA","value":"Nora Dossche","lang":"en"},{"source":"CNA","value":"Jakub Zelenka","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"92842","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php","cpe5":"php","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"92842","cve":"CVE-2026-92842","epss":"0.003570000","percentile":"0.268990000","score_date":"2026-09-29","updated_at":"2026-09-30 00:11:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-92842","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-28T12:56:55.648676Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-28T13:31:31.256Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"ext-standard","product":"PHP","vendor":"PHP Group","versions":[{"lessThan":"8.2.34","status":"affected","version":"8.2.*","versionType":"semver"},{"lessThan":"8.3.35","status":"affected","version":"8.3.*","versionType":"semver"},{"lessThan":"8.4.26","status":"affected","version":"8.4.*","versionType":"semver"},{"lessThan":"8.5.11","status":"affected","version":"8.5.*","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"@geeknik (GitHub)"},{"lang":"en","type":"remediation developer","value":"Nora Dossche"},{"lang":"en","type":"remediation reviewer","value":"Jakub Zelenka"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>The <code>convert.base64-encode</code>, <code>convert.quoted-printable-encode</code> and <code>convert.quoted-printable-decode</code> stream filters accept a <code>line-break-chars</code> option whose length is tracked separately from the string itself. The filter constructors duplicate the value with <code>pestrdup()</code>, which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.</p>"}],"value":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}],"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"CWE-122 Heap-based buffer overflow","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-125","description":"CWE-125 Out-of-bounds read","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-25T21:11:57.236Z","orgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","shortName":"php"},"references":[{"tags":["vendor-advisory"],"url":"https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"}],"source":{"discovery":"UNKNOWN"},"title":"OOB read / info leak in convert.* stream filters when line-break-chars contains NUL","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","assignerShortName":"php","cveId":"CVE-2026-92842","datePublished":"2026-09-25T21:11:57.236Z","dateReserved":"2026-09-17T02:52:30.905Z","dateUpdated":"2026-09-28T13:31:31.256Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 22:18:49","lastModifiedDate":"2026-10-27 15:33:55","problem_types":["CWE-122","CWE-125","CWE-122 CWE-122 Heap-based buffer overflow","CWE-125 CWE-125 Out-of-bounds read"],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T12:56:55.648676Z","id":"CVE-2026-92842","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.34","matchCriteriaId":"AAFB3643-4D71-46ED-8184-DDE5FE41CD02"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.35","matchCriteriaId":"FF664EE8-D417-45A4-84DF-158F5073FDE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.26","matchCriteriaId":"52D4BECA-EF0D-4180-837C-AEFA7A12D243"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.11","matchCriteriaId":"308803C0-9FC8-40D2-8920-B83BCC48014F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"92842","Ordinal":"1","Title":"OOB read / info leak in convert.* stream filters when line-break","CVE":"CVE-2026-92842","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"92842","Ordinal":"1","NoteData":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.","Type":"Description","Title":"OOB read / info leak in convert.* stream filters when line-break"}]}}}