Buffer overflow in PHP Group
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
Vulnerability class: Buffer Overflow
Published .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-92842?
- CVE-2026-92842 is a medium-severity vulnerability in PHP Group, classified under Heap-based Buffer Overflow. CVSS score: 5.9/10. Published 2026-09-25.
- How severe is CVE-2026-92842?
- Medium severity. CVSS v3 base score is 5.9 out of 10.