CVE-2026-101877

Last verified 2h ago

PHP mb_strcut heap over-read

Exploited in the wild?

No evidence

Public exploit?

GitHub, Exploit-DB, Metasploit

None known

Patch available?

No patch

Severity

CVSS v3.1

5.3 MEDIUM

Risk signals

Known exploited

Not in KEV

EPSS probability

41th percentile

PoC repos

CVSS

5.3

Workaround only: avoid passing untrusted lengths to mb_strcut().

Per-distro commands are being verified

Our team is confirming fixed package versions for PHP. Use your distribution's security tracker in the meantime.

Still the most-scanned bug on the internet. Embedded Log4j in vendor appliances keeps it alive.

Encoded dot segments escape DocumentRoot; with mod_cgi enabled, leads to RCE.

Specific nginx fastcgi_split_path_info configs allow RCE in PHP-FPM.