PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVE-2026-92842 is a medium severity heap-based buffer overflow vulnerability in PHP related to the convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters. The issue arises because the filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value using pestrdup(), which stops at the first NUL byte but retains the original length. This discrepancy allows the filter to read past the allocated buffer when emitting a line break, potentially leaking adjacent heap memory into the output.
CVE-2026-91768 is a vulnerability in the PHP FastCGI client access check for IPv6 addresses. The check incorrectly compares only the first 12 bytes of a 16-byte IPv6 address, effectively matching on a /96 prefix rather than the full address. This allows an attacker with an IPv6 address sharing the first 96 bits with an allowed client to bypass access restrictions and reach the FastCGI endpoint. The vulnerability has a medium severity with a CVSS score of 6.5.
A heap-based buffer overflow vulnerability exists in PHP's OpenSSL extension function php_openssl_matches_wildcard_name(). This occurs when a TLS server certificate presents a wildcard name whose literal characters are longer than the hostname being verified, causing an underflow in the length argument passed to memchr(). This can lead to reading memory beyond the allocated heap buffer. The vulnerability is reachable from any default PHP client stream since verify_peer_name is enabled by default.
CVE-2026-91769 is a vulnerability in PHP's OpenSSL stream peer verification where certificate validation incorrectly accepts certificates with a host name mismatch. Specifically, if a certificate includes subjectAltName (SAN) entries, PHP improperly falls back to validating the Common Name (CN) when no SAN matches, violating RFC 6125. This flaw allows a certificate trusted for one hostname to be used to impersonate another, potentially enabling man-in-the-middle attacks. The vulnerability has a medium severity with a CVSS score of 4.3. No affected versions or patch information are explicitly provided.
CVE-2026-91766 is a medium severity vulnerability in PHP where the http:// stream wrapper forwards sensitive headers such as Authorization, Cookie, and Proxy-Authorization unchanged when following redirects. This occurs even if the redirect target is a different host, port, or downgrades from HTTPS to HTTP, potentially exposing credentials to unintended servers.
CVE-2026-91765 is a high-severity vulnerability in the PHP SOAP XML parser where the cleanup_xml_node() function recurses without a depth limit. This allows an unauthenticated attacker to send a SOAP request with extremely deep nesting, causing stack exhaustion and crashing the SoapServer process. The unbounded recursion also affects the SOAP value decoder and WSDL node search helper.
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
CVE-2026-93682 is an out-of-bounds read vulnerability in the PHP HTTP stream wrapper. When following a redirect, if the Location header is empty, the code reads one byte beyond the allocated buffer. This byte influences the redirect target, allowing a malicious server to control whether the client is redirected to the host root or the current directory. The vulnerability has a medium severity with a CVSS score of 5.8.
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
CVE-2026-7260 is a stack-based buffer overflow vulnerability in PHP caused by circular symbolic links in phar archives. This flaw can trigger unbounded recursion, exhausting the C stack and crashing the PHP process. It affects PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation level is currently confirmed in the provided data.
CVE-2026-17544 is a high-severity vulnerability in the PHP programming language affecting versions 8.4.0 through 8.4.23 and 8.5.0 through 8.5.8. It involves an out-of-bounds write triggered by attacker-controlled inputs to the bccomp() function, which can cause stack and heap corruption. This vulnerability could potentially lead to serious memory corruption issues. No official patch or remediation level has been confirmed yet.
CVE-2026-17543 is a high-severity SQL injection vulnerability in PHP caused by improper escaping of backslashes in attacker-supplied parameters. It affects multiple PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. This flaw allows attackers to perform SQL injection attacks due to improper neutralization of special elements in SQL commands. No official patch or remediation level is currently confirmed.
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.