CVE-2026-7259 is a NULL pointer dereference vulnerability (CWE-476) affecting PHP versions 8.2.*, 8.3.*, 8.4.*, and 8.5.* before specific patch versions (8.2.31, 8.3.31, 8.4.21, 8.5.6). The issue arises from a mismatch between encoding lists in the Oniguruma regex library and the mbfl multibyte function library, which leads to a NULL pointer dereference when user input controls the encoding passed to mb_regex_encoding(). This results in a segmentation fault causing denial of service. The vulnerability requires user interaction and has a low attack complexity and impact, reflected in a CVSS 4.0 base score of 2.1. No known exploits are reported in the wild, and no official patch or vendor advisory confirming remediation is currently available.

Successful exploitation causes a segmentation fault leading to denial of service in affected PHP versions. There is no indication of code execution or data disclosure. The impact is limited to service availability disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid passing user-controlled input to mb_regex_encoding() or implement input validation to restrict encoding values. Monitor PHP Group advisories for updates.