Search: CVE-2026-92842

CVE-2026-92842 is a medium severity heap-based buffer overflow vulnerability in PHP related to the convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters. The issue arises because the filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value using pestrdup(), which stops at the first NUL byte but retains the original length. This discrepancy allows the filter to read past the allocated buffer when emitting a line break, potentially leaking adjacent heap memory into the output.