A heap buffer overflow occurs in PHP’s OpenSSL wrapper when the function php_openssl_matches_wildcard_name compares a wildcard certificate CN whose literal characters exceed the hostname being verified. The function underflows the length argument to memchr, causing PHP to read up to SIZE_MAX bytes past the end of a heap allocation, which can lead to an out‑of‑bounds read, memory corruption, and potentially arbitrary code execution or a crash of the PHP process.

The vulnerability affects the PHP Group’s PHP implementation. No specific affected versions are listed in the advisory, so any installed PHP that has not yet been updated to the patched release is potentially vulnerable.

The CVSS score of 6.5 rates the issue as medium severity, and with no EPSS data available the likelihood of exploitation remains uncertain. The path is reachable from any default client stream, as peer name verification is enabled by default. An attacker who can control the server certificate presented to a PHP client can exploit this flaw from the client side, achieving code execution or denial of service if successful. The vulnerability is not listed in the CISA KEV catalog.