A NUL byte in the line-break-chars stream filter parameter causes a buffer over-read.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.5 | < 8.5.11 | 8.5.11 |
| PHP 8.4 | < 8.4.26 | 8.4.26 |
| PHP 8.3 | < 8.3.35 | 8.3.35 |
| PHP 8.2 | < 8.2.34 | 8.2.34 |
Older branches: not assessed
Exploitation conditions
No special conditions are documented.
Remediation
Upgrade to 8.2.34, 8.3.35, 8.4.26, 8.5.11 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 5.9 v3.1 | CNA | — |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: Assembled from secondary sources (distribution trackers, release coverage). Publication date reflects the upstream fix release. Severity not yet verified unless a score is listed.