AIKIDO-2026-10962

TL;DR

The Symfony Mime component restores message and part state through __unserialize on Email, TextPart, and SMimePart. Before the fix, assigning attacker-controlled array values into typed string properties let PHP coerce Stringable objects via __toString before post-assignment checks ran. Crafted serialized MIME object payloads could therefore invoke attacker-chosen __toString logic during unserialize when an application deserializes untrusted data. The fix rejects Stringable values in the raw serialized data before any typed-string assignment.