Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)
A null pointer dereference vulnerability exists in the PHP function php_mb_check_encoding() when used via mb_ereg_search_init(). This occurs due to a mismatch between encoding lists in Oniguruma and mbfl, leading to a segmentation fault and denial of service. The issue affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. Exploitation requires user-controlled input influencing the encoding passed to mb_regex_encoding().
AI Analysis
Technical Summary
CVE-2026-7259 is a vulnerability in PHP where a mismatch between encoding lists in the Oniguruma regex library and mbfl causes a null pointer dereference in php_mb_check_encoding() when invoked via mb_ereg_search_init(). This results in a segmentation fault, causing denial of service. The vulnerability is present in PHP versions 8.2.0 up to but not including 8.2.31, 8.3.0 up to but not including 8.3.31, 8.4.0 up to but not including 8.4.21, and 8.5.0 up to but not including 8.5.6. Exploitation is possible if an attacker can control the encoding parameter passed to mb_regex_encoding().
Potential Impact
Successful exploitation causes a segmentation fault leading to denial of service in affected PHP versions. There is no indication of code execution or data disclosure. The impact is limited to service disruption.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to PHP versions 8.2.31 or later, 8.3.31 or later, 8.4.21 or later, or 8.5.6 or later to remediate the issue. No additional mitigation steps are indicated.
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)
Description
A null pointer dereference vulnerability exists in the PHP function php_mb_check_encoding() when used via mb_ereg_search_init(). This occurs due to a mismatch between encoding lists in Oniguruma and mbfl, leading to a segmentation fault and denial of service. The issue affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. Exploitation requires user-controlled input influencing the encoding passed to mb_regex_encoding().
Affected software
pkg:bitnami/phpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7259 is a vulnerability in PHP where a mismatch between encoding lists in the Oniguruma regex library and mbfl causes a null pointer dereference in php_mb_check_encoding() when invoked via mb_ereg_search_init(). This results in a segmentation fault, causing denial of service. The vulnerability is present in PHP versions 8.2.0 up to but not including 8.2.31, 8.3.0 up to but not including 8.3.31, 8.4.0 up to but not including 8.4.21, and 8.5.0 up to but not including 8.5.6. Exploitation is possible if an attacker can control the encoding parameter passed to mb_regex_encoding().
Potential Impact
Successful exploitation causes a segmentation fault leading to denial of service in affected PHP versions. There is no indication of code execution or data disclosure. The impact is limited to service disruption.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to PHP versions 8.2.31 or later, 8.3.31 or later, 8.4.21 or later, or 8.5.6 or later to remediate the issue. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-php-2026-7259
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-7259"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
Threat ID: 6aa005dcacd9273b49ab6032
Added to database: 09/08/2026, 12:55:56 UTC
Last enriched: 09/08/2026, 13:26:59 UTC
Last updated: 09/10/2026, 19:36:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.