- CVE-2026-92842: heap over-read in the convert stream filters. The base64-encode, quoted-printable-encode and quoted-printable-decode filter constructors duplicated line-break-chars with pestrdup(), which stops at the first NUL, while keeping the option's real length, so every memcpy() of lbchars_len bytes in the filter body read past the allocation. They now use pestrndup(). - CVE-2025-14181: buffer overflow in the SOAP client reading a chunked HTTP response. get_http_body() accumulated the body length in a signed int and guarded growth with a signed-overflow test, so a hostile endpoint could wrap the reallocation length and make the following read write out of bounds. The accumulator is now a size_t, each growth step is bounded against ZSTR_MAX_LEN and the chunked path reallocates through zend_string_safe_realloc(). - CVE-2026-6103: tar entry injection in ext/phar. Entry sizes were parsed with an unchecked 32-bit accumulator that also ignored trailing garbage, and data blocks were skipped only for typeflag '\0' and TAR_FILE, so a crafted archive left the stream on attacker-controlled payload that was parsed as the next tar header. Unparseable or unrepresentable sizes are rejected, the unsupported GNU long link record is refused, the long name is bounded by the archive size, and every entry type that carries data is skipped. - CVE-2026-91765: stack exhaustion in ext/soap on deeply nested XML. The two tree walks in php_xml.c were self-recursive and the decoder re-entered itself per nesting level and per href hop, unbounded, with XML_PARSE_HUGE removing libxml2's own limit. Both walks are now iterative, over-deep documents are rejected where libxml2 enforces no limit, and the decoder is capped by a per-request depth counter.