In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, passing an encoding name containing an embedded NUL byte to mb_convert_encoding() or related mbstring functions causes the code to misinterpret the result of strncasecmp(). This results in an out-of-bounds read of global memory, which can lead to a crash or disclosure of sensitive data.

The vulnerability affects PHP installed by the PHP Group. It applies to the PHP 8.4 series prior to release 8.4.21 and the PHP 8.5 series prior to release 8.5.6. Functions impacted include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), mb_detect_order(), and the INI settings mbstring.detect_order and mbstring.http_output.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. An attacker would need to supply a crafted encoding string containing a NUL byte to a reachable mbstring function, which could be achieved if the application accepts user input for encoding names. Once executed, the out-of-bounds read may crash the PHP process or expose data from global memory, but remote code execution is not directly supported by the information provided.