Buffer overflow in PHP
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (20.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.003 · change: -0.001
Affected products
Weakness classification (CWE)
References
- github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6 (Exploit, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-92842?
- CVE-2026-92842 is a medium-severity vulnerability in PHP, classified under Heap-based Buffer Overflow. CVSS score: 5.9/10. Published 2026-09-25.
- How severe is CVE-2026-92842?
- Medium severity. CVSS v3 base score is 5.9 out of 10.