CVE-2026-92842: 
PHP vulnerability analysis and mitigation

CVE-2026-92842 is a heap-based out-of-bounds read and information leak vulnerability in PHP's convert.* stream filters (specifically convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode). When the line-break-chars option contains embedded NUL bytes, the filter constructors duplicate the value using pestrdup() (which stops at the first NUL) while retaining the original, untruncated length — causing subsequent line-break emission to read past the end of the allocation and copy adjacent heap bytes into the filter output. It affects PHP versions before 8.2.34, 8.3.35, 8.4.26, and 8.5.11, and was published on September 24, 2026. The CVSS v3.1 base score is 5.9 (Moderate) (GitHub Advisory).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-125 (Out-of-bounds Read). In php_conv_base64_encode_ctor(), php_conv_qprint_encode_ctor(), and php_conv_qprint_decode_ctor() within ext/standard/filters.c, the line-break-chars option is duplicated with pestrdup(), which terminates at the first NUL byte, but the original (full) length is stored separately. When the encoder later inserts a line break, it copies lbchars_len bytes from the truncated allocation — reading one or more bytes past the end of the heap buffer. For example, setting line-break-chars to "\0X" results in a one-byte allocation while lbchars_len is 2, causing a one-byte over-read; extending the value after the NUL increases the leak size. The fix replaces pestrdup() with pestrndup(lbchars, lbchars_len, persistent) in all three constructors. A PoC using ASAN is publicly available in the advisory (GitHub Advisory).

Successful exploitation leaks heap memory adjacent to the line-break-chars allocation into the filter's encoded output, which is then returned to the requester. An attacker can increase the volume of leaked data by lengthening the option value after the embedded NUL byte. While the primary risk is confidentiality — potentially exposing sensitive heap contents such as credentials, keys, or other in-memory data — a crash is also possible on certain allocators and build configurations, though this is less likely in practice (GitHub Advisory).

Exploitation requires an attacker to control the line-break-chars option passed to one of the affected stream filters, and for that value to contain an embedded NUL byte — a condition described as rare in practice, meaning the majority of applications are not affected. A public PoC using AddressSanitizer is included in the GitHub Security Advisory. The CVE status is listed as "Reserved" with no confirmed in-the-wild exploitation, no CISA KEV listing, and no EPSS score currently published. Nessus detection plugins (IDs 349694, 349787, 349788) have been released to identify vulnerable systems (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Find a PHP application (versions < 8.2.34, 8.3.35, 8.4.26, or 8.5.11) that accepts user-controlled input and passes it as the line-break-chars option to a convert.base64-encode, convert.quoted-printable-encode, or convert.quoted-printable-decode stream filter.
2. Craft a malicious payload: Prepare a line-break-chars value containing an embedded NUL byte followed by additional bytes (e.g., "\x00X" or a longer sequence). The longer the suffix after the NUL, the more heap bytes will be read out of bounds.
3. Deliver the payload: Submit the crafted value via the application's input mechanism — for example, via an HTTP GET/POST parameter that the application decodes and passes directly to the filter options (e.g., base64_decode($_GET['lb64']) used as line-break-chars).
4. Trigger the filter: Cause the application to invoke the stream filter with the malicious option, such as by appending convert.base64-encode to a stream and reading from it, which triggers line-break emission.
5. Collect leaked heap data: Capture the encoded output returned by the application. The bytes following the NUL in the line-break position will contain raw heap memory adjacent to the line-break-chars allocation, potentially including sensitive data (GitHub Advisory).

• Network: HTTP requests containing base64-encoded or raw values with embedded NUL bytes (%00) in parameters that are passed to stream filter options; unusual encoded output in HTTP responses containing non-printable or unexpected byte sequences.
• Logs: PHP error logs showing heap-related warnings or crashes (e.g., from ASAN or allocator instrumentation) in contexts involving convert.base64-encode or convert.quoted-printable-* filters; access logs with requests supplying line-break-chars-related parameters with NUL-containing values.
• Process: PHP processes crashing or producing unexpected output when processing stream filter operations with line-break-chars options containing NUL bytes (GitHub Advisory).

PHP has released patched versions 8.2.34, 8.3.35, 8.4.26, and 8.5.11, all published on September 24, 2026. Upgrading to one of these versions is the recommended remediation. As a workaround where upgrading is not immediately possible, applications should validate and sanitize the line-break-chars option to reject any values containing NUL bytes before passing them to stream filters. Restricting user-controlled input from reaching stream filter options entirely is the most effective defense (GitHub Advisory, PHP Changelog).

The vulnerability was reported by researcher "geeknik" and published by the PHP security team (bukka) via GitHub Security Advisories. Security news outlet SecurityOnline.info covered the broader PHP patch release that included this fix. The Remi repository blog noted the availability of patched PHP packages for RHEL and Fedora. Community reaction has been measured given the moderate severity and the narrow exploitation preconditions required (SecurityOnline, Remi Blog).