- CVE-2026-92842: the convert.base64-encode and convert.quoted-printable-* stream filters copied line-break-chars with pestrdup(), which stops at the first NUL byte, but kept the original length, so a NUL in the option caused a heap out-of-bounds read; copy exactly lbchars_len bytes - CVE-2025-14181: SoapClient summed chunked HTTP body sizes in an int, so a large chunk size overflowed the check and the realloc and caused a heap buffer overflow; use a size_t total, bound each growth step against ZSTR_MAX_LEN and use overflow-checked (re)allocation - CVE-2026-6103: PharData/Phar accepted tar entry sizes that overflowed or were not valid octal, and did not skip the data blocks of entry types other than regular files, so attacker data was parsed as extra tar headers (entry injection); reject invalid sizes and GNU long link records, bound ././@LongLink names by the archive size, and skip the data of every data-carrying entry type - CVE-2026-91765: ext/soap walked deeply nested XML and href reference chains recursively, so a crafted SOAP message or WSDL exhausted the C stack; walk the tree iteratively, reject documents nested deeper than 2048 levels on libxml2 < 2.13, and cap decoding depth