A mismatch between encoding lists in Oniguruma and mbfl causes a NULL pointer dereference that leads to a segmentation fault, causing the PHP process to crash and resulting in a denial of service due to resource exhaustion or unavailability. The weakness is identified as a null pointer dereference (CWE‑476).

The vulnerability affects PHP releases 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6 from the PHP Group. Any web application running one of these affected PHP versions is potentially impacted.

The CVSS score of 2.1 classifies the severity as low; however, the exploit requires that an attacker can influence the encoding parameter passed to mb_regex_encoding(), which typically occurs when user input reaches this function. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not currently documented. Despite the low score, an attacker who can inject controlled data into the encoding argument can trigger a fatal crash of the PHP interpreter, leading to denial of service for the affected web service.