PHP functions such as urldecode() pass signed characters to ctype routines like isxdigit, which on platforms that use a signed char default together with an optimized table‑lookup implementation of ctype can trigger an array access with a negative offset. This out‑of‑bounds read, identified as CWE‑125 and CWE‑839, may cause the PHP interpreter to crash or otherwise become unavailable, resulting in a denial of service for applications that invoke the vulnerable routines with untrusted input.

The flaw exists in PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. Systems running NetBSD, which employ a signed char default and use optimized ctype table lookups, are explicitly susceptible, but other platforms with similar default settings and ctype implementations may also be affected. Any deployment of PHP in these version ranges on such operating systems is at risk.

The CVSS score of 6.3 reflects a moderate severity associated primarily with availability loss. An EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread attacks. An attacker would need to supply malformed URL data that is processed by PHP; this can be accomplished remotely if the PHP instance receives untrusted input from a web application, or locally if privileged code can execute the vulnerable function. The exploit path is straightforward once the vulnerable PHP version is in use, and the impact is a forced termination of the PHP process, which restores availability after service restart.