PHP’s filesystem and stream APIs on Windows do not reject reserved device names such as CON, PRN, AUX, NUL, COM1‑COM9, LPT1‑LPT9, CONIN$ and CONOUT$ when they appear as part of a file path. As a result the operating system opens the named device instead of the requested file, causing a request to block or hang and eventually exhausting all worker processes. The flaw is a classic filename validation failure, represented by CWE‑66 and CWE‑67.

The vulnerability affects all PHP releases that run on Windows. No specific version constraints are listed, so any Windows‑enabled PHP installation that has not applied an official fix remains at risk.

The CVSS score of 6.9 indicates medium severity, and the EPSS score is not available while the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of exploitation. The attack vector is straightforward; an application that forwards an attacker‑controlled filename to PHP’s stream API will trigger the bug, making the flaw easy to exploit in a susceptible environment.