This vulnerability (CVE-2026-6104) affects PHP 8.4 and 8.5 series prior to versions 8.4.21 and 8.5.6 respectively. When mbstring functions receive an encoding name with an embedded NUL byte, the internal use of strncasecmp() incorrectly assumes equal string length if it returns 0, which is not guaranteed. This leads to an out-of-bounds read of global memory, potentially causing application crashes or information disclosure. The affected mbstring functions and INI settings include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), mb_detect_order(), mbstring.detect_order, and mbstring.http_output. The CVSS 4.0 base score is 6.3, indicating medium severity. No patch or official remediation level is currently documented in the provided data.

The vulnerability can lead to out-of-bounds memory reads in PHP mbstring functions, which may cause application crashes or potentially leak sensitive information from memory. This impacts applications using affected PHP versions (8.4.* before 8.4.21 and 8.5.* before 8.5.6) that invoke these mbstring functions with specially crafted encoding names containing embedded NUL bytes. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the PHP Group vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the available data, users should monitor PHP Group announcements for updates. Until a fix is available, avoid passing encoding names with embedded NUL bytes to mbstring functions as a precaution.