The vulnerability is a buffer allocation flaw in PHP's OpenSSL extension that occurs when the AES‑WRAP‑PAD algorithm is used. The routine calculates the output buffer size based solely on the plaintext length and ignores the padding expansion required by RFC 5649, causing OpenSSL to write beyond the allocated memory. This corrupts heap metadata and leads the PHP interpreter to abort, resulting in a denial‑of‑service without granting code execution or data disclosure.

The flaw affects PHP versions 8.2.x before 8.2.32, 8.3.x before 8.3.32, 8.4.x before 8.4.23, and 8.5.x before 8.5.8 when the OpenSSL extension's AES‑WRAP‑PAD function is invoked. Any PHP application configured to use that algorithm is vulnerable; applications that never call openssl_encrypt with AES‑WRAP‑PAD are not affected.

The CVSS score of 5.6 places the vulnerability in the moderate range and the EPSS score of less than 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the fault by supplying crafted input to openssl_encrypt with AES‑WRAP‑PAD, but requires the ability to control application input, which limits the attack surface to sites where user input reaches the vulnerable routine.