Vulnerability · Published May 10, 2026 · Assigned by php
CVE-2026-7259Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
Low 2.1
In plain English
A low-severity null pointer dereference in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | php | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-bcmath | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-bcmath | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-cli | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-cli | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-common | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-common | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-dba | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-dba | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-dbg | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-dbg | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-devel | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-devel | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-embedded | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-embedded | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-enchant | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-enchant | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-ffi | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-ffi | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-fpm | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-fpm | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-gd | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-gd | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-gmp | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-gmp | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-intl | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-intl | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-ldap | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-ldap | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-mbstring | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-mbstring | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-mysqlnd | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-mysqlnd | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-odbc | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-odbc | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-opcache | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-opcache | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-pdo | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-pdo | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-pgsql | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-pgsql | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-process | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-process | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-snmp | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-snmp | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-soap | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-soap | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| AlmaLinux:10 | php-xml | 8.3.31-1.el10_2 | ALSA-2026:23388 |
| AlmaLinux:9 | php-xml | 8.0.30-6.el9_8 | ALSA-2026:33449 |
| Alpine:v3.22 | php82 | 8.2.31-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.22 | php83 | 8.3.36-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.23 | php83 | 8.3.31-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.24 | php83 | 8.3.31-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.22 | php84 | 8.4.27-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.23 | php84 | 8.4.21-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.24 | php84 | 8.4.21-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.23 | php85 | 8.5.6-r0 | ALPINE-CVE-2026-7259 |
| Alpine:v3.24 | php85 | 8.5.6-r0 | ALPINE-CVE-2026-7259 |
| Debian:12 | php8.2 | 8.2.31-1~deb12u1 | DEBIAN-CVE-2026-7259 |
| Debian:13 | php8.4 | 8.4.21-1~deb13u1 | DEBIAN-CVE-2026-7259 |
| Debian:14 | php8.4 | 8.4.21-1 | DEBIAN-CVE-2026-7259 |
| Rocky Linux:10 | php | 0:8.3.31-1.el10_2 | RLSA-2026:23388 |
| Rocky Linux:9 | php | 0:8.0.30-6.el9_8 | RLSA-2026:33449 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.24 | UBUNTU-CVE-2026-7259 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.9 | UBUNTU-CVE-2026-7259 |
| Ubuntu:25.10 | php8.4 | 8.4.11-1ubuntu1.2 | UBUNTU-CVE-2026-7259 |
| Ubuntu:26.04:LTS | php8.5 | 8.5.4-0ubuntu1.1 | UBUNTU-CVE-2026-7259 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber