CVE-2026-93682
PHP: out-of-bounds read
- Risk score
- 56/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the …
- Affected
- PHP
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 5.8 medium
- Public exploit or proof of concept referenced
- On your watchlist: php
References
Original description
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
Last activity 25 Sep 2026. Patch Forecast updates every hour.