Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
- CVE
- CVE-2026-6104
- GHSA
- GHSA-74r9-qxhc-fx53
- Source
- php-src
- Reported
- May 7, 2026
Affected and fixed versions
In PHP itself. Find the row for the version you run, and update to the release next to it.
| If you run | Update to | Support |
|---|---|---|
| 8.5.0 – 8.5.5 | 8.5.6 | Supported |
| 8.4.0 – 8.4.20 | 8.4.21 | Supported |
Upgrade
Update PHP to the release for the branch you are on, wherever it is installed: your Docker image, server packages or hosting panel. Branches past end of life get no fix, so move to a supported branch.
- PHP 8.5.6
- PHP 8.4.21
Check your app with an agent
Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It finds the PHP versions your project runs on and checks them against the versions above, without changing anything.
Check whether the PHP project you have access to runs a PHP version affected by this security advisory in PHP itself, and tell me what to update. Do a read-only check: don't edit files, don't change any PHP install, and don't try to reproduce the flaw. Advisory: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104, GHSA-74r9-qxhc-fx53) Details: https://phpnews.net/security/php/ghsa-74r9-qxhc-fx53 Fixed releases on branches that still get security fixes: - 8.5.0 – 8.5.5: update to 8.5.6 - 8.4.0 – 8.4.20: update to 8.4.21 Branches past end of life get no fix: any version on one of them should be treated as affected. 1. Find every place the project pins or installs PHP: Dockerfiles and compose files, CI workflows, deploy and provisioning scripts, platform config (.php-version, Forge, Vapor, Cloud or Herd settings), and composer.json's config.platform.php and require.php. 2. For each, read the PHP version it runs. Where only a branch is given (php:8.3, PHP 8.3), say the patch version depends on when the image or server was last updated. 3. Compare each version with the fixed releases above. 4. Read the advisory and say whether the project uses what it describes (a function, extension or SAPI). Say which you could check and which you couldn't. 5. Report a table: file | PHP version | affected (yes, no or unknown) | uses the affected feature (yes, no or unknown) | update to | evidence.