Critical Alert 4 Active Exploits Detected Today

CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability →
CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability →
CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability →
CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability →
Powered by CVE Watchtower
×

CVE Watchtower


← Back to CVE List

CVE-2026-6104NVD

Vulnerability Summary

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
Severity Level
UNKNOWN
Published Date
May 10, 2026
Last Modified
Jul 15, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.47%Probability
Root Weakness (CWE)
N/A