Windows Best-Fit character mapping converts a soft hyphen into a regular hyphen, letting attackers pass command-line options to PHP-CGI through the query string and execute arbitrary code. It bypasses the protection for CVE-2012-1823.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.3 | < 8.3.8 | 8.3.8 |
| PHP 8.2 | < 8.2.20 | 8.2.20 |
| PHP 8.1 | < 8.1.29 | 8.1.29 |
Older branches: not assessed
Exploitation conditions
- Windows only
- PHP running in CGI mode, or PHP executables exposed by the web server
- Certain system code pages (for example Traditional/Simplified Chinese and Japanese locales)
Remediation
Upgrade to PHP 8.1.29, 8.2.20 or 8.3.8 or later (note the follow-up bypass CVE-2024-8926, fixed in 8.1.30, 8.2.24 and 8.3.12). Avoid PHP-CGI on Windows; use PHP-FPM or a supported SAPI. Older Windows PHP releases (7.x, 5.x) are end-of-life and unfixed.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 9.8 v3.1 | CNA | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: Listed in CISA KEV. Unsupported branches are not assessed by upstream; Windows CGI deployments of those branches should be treated as at risk.