VDB
CVE-2026-7259
CVE-2026-7259
PUBLISHED
CVSS 2.0999999046325684 LOW
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
EPSS 0.05% · 16.6th percentile
Risk Scores
CVSS v4.0
2.0999999046325684
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber
EPSS Score
0.05%
16.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PHP Group | PHP | 8.2.*, 8.4.*, 8.5.* |
Timeline
- May 8, 2026 PoC Published
- May 8, 2026 PoC Published
- May 10, 2026 EPSS Score
- May 10, 2026 CVE Published
- May 11, 2026 Security Advisory
- May 11, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score