The vulnerability is a buffer allocation flaw in PHP’s OpenSSL extension when the AES‑WRAP‑PAD algorithm is used. The routine calculates the output buffer size based only on the plaintext length and fails to account for the padding expansion defined by RFC 5649. This heap‑based buffer overflow allows OpenSSL to write past the end of the allocated buffer, corrupting heap metadata and causing the PHP process to abort. The attack results in an application crash rather than code execution or data disclosure.

The flaw affects PHP 8.2.* before 8.2.32, PHP 8.3.* before 8.3.32, PHP 8.4.* before 8.4.23, and PHP 8.5.* before 8.5.8. Systems running these versions with the default OpenSSL extension are vulnerable if they call openssl_encrypt using the AES‑WRAP‑PAD algorithm.

The CVSS score of 5.6 places the vulnerability in the moderate range, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. The buffer overflow can be triggered by supplying malicious data that causes openssl_encrypt to use AES‑WRAP‑PAD, leading to denial‑of‑service via application abort. An attacker must control input to a PHP application that uses the vulnerable routine, which limits the attack surface.