Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-92842

Fixed in a distro release EPSS <1%CVSS 5.9

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.

Published 2026-09-25 · CVE record · OSV

Products: PHP Group PHP

Distro releases

ReleasePackageFixed in
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-bcmath7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-cli7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-common7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-dba7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-dbg7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-devel7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-embedded7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-enchant7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-ffi7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-fpm7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-gd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-gmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-intl7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-json7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-ldap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-mbstring7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-mysqlnd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-odbc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-opcache7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-pdo7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pgsql7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-process7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-snmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-soap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-xml7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-xmlrpc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
Debian:12php8.28.2.34-1~deb12u1
Debian:13php8.48.4.26-1~deb13u1
Debian:14php8.48.4.26-1
Red Hat:hummingbird:1php0:8.5.11-2.hum1
Red Hat:hummingbird:1php-bcmath0:8.5.11-2.hum1
Red Hat:hummingbird:1php-cli0:8.5.11-2.hum1
Red Hat:hummingbird:1php-common0:8.5.11-2.hum1
Red Hat:hummingbird:1php-dba0:8.5.11-2.hum1
Red Hat:hummingbird:1php-dbg0:8.5.11-2.hum1
Red Hat:hummingbird:1php-devel0:8.5.11-2.hum1
Red Hat:hummingbird:1php-embedded0:8.5.11-2.hum1
Red Hat:hummingbird:1php-enchant0:8.5.11-2.hum1
Red Hat:hummingbird:1php-ffi0:8.5.11-2.hum1
Red Hat:hummingbird:1php-fpm0:8.5.11-2.hum1
Red Hat:hummingbird:1php-gd0:8.5.11-2.hum1
Red Hat:hummingbird:1php-gmp0:8.5.11-2.hum1
Red Hat:hummingbird:1php-intl0:8.5.11-2.hum1
Red Hat:hummingbird:1php-ldap0:8.5.11-2.hum1
Red Hat:hummingbird:1php-mbstring0:8.5.11-2.hum1
Red Hat:hummingbird:1php-mysqlnd0:8.5.11-2.hum1
Red Hat:hummingbird:1php-odbc0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo-dblib0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo-firebird0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pgsql0:8.5.11-2.hum1
Red Hat:hummingbird:1php-process0:8.5.11-2.hum1
Red Hat:hummingbird:1php-snmp0:8.5.11-2.hum1
Red Hat:hummingbird:1php-soap0:8.5.11-2.hum1
Red Hat:hummingbird:1php-sodium0:8.5.11-2.hum1
Red Hat:hummingbird:1php-tidy0:8.5.11-2.hum1
Red Hat:hummingbird:1php-xml0:8.5.11-2.hum1
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1912+72767185
Rocky Linux:8php0:7.4.33-8.module+el8.10.0+40393+c071e357
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1605+02e07af7
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.4.0+414+2e7afcdd
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Module for Legacy 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Legacy 15 SP7php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-embed7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-test7.4.33-150400.4.81.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7apache2-mod_php88.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php88.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-embed8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-fastcgi8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-fpm8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-test8.3.35-150700.3.21.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server 15 SP5-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server 15 SP6-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSapache2-mod_php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-embed8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-fastcgi8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-fpm8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-test8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 16.0apache2-mod_php88.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php88.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-embed8.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-fastcgi8.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-fpm8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-embed8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-fastcgi8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-fpm8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-test8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-mod_php88.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php88.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-embed8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-fastcgi8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-fpm8.4.26-160000.1.1
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.27
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.12
Ubuntu:26.04:LTSphp8.58.5.4-0ubuntu1.4
Ubuntu:26.10php8.58.5.9-0ubuntu2
Ubuntu:Pro:14.04:LTSphp55.5.9+dfsg-1ubuntu4.29+esm17
Ubuntu:Pro:16.04:LTSphp7.07.0.33-0ubuntu0.16.04.16+esm21
Ubuntu:Pro:18.04:LTSphp7.27.2.24-0ubuntu0.18.04.17+esm13
Ubuntu:Pro:20.04:LTSphp7.47.4.3-4ubuntu2.29+esm4
openSUSE:Leap 16.0apache2-mod_php88.4.26-160000.1.1
openSUSE:Leap 16.0php88.4.26-160000.1.1
openSUSE:Leap 16.0php8-embed8.4.26-160000.1.1
openSUSE:Leap 16.0php8-fastcgi8.4.26-160000.1.1
openSUSE:Leap 16.0php8-fpm8.4.26-160000.1.1
openSUSE:Leap 16.0php8-test8.4.26-160000.1.1
openSUSE:Tumbleweedphp88.5.11-1.1