The vulnerability occurs in the convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode PHP stream filters. A line-break-chars value that contains a NUL byte causes the filter constructor to duplicate the string with pestrdup(), which stops at the first NUL while keeping the original length. When the filter later emits a line break, it copies the recorded length out of the truncated allocation, reading past its end and copying adjacent heap bytes into the filter output. This out-of-bounds read can leak sensitive data such as credentials, private keys or other memory contents. The weakness is categorized as CWE-122 (Out-of-Bounds Read) and CWE-125 (Buffer Underrun).

The affected component is the PHP interpreter, specifically the convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters. The advisory lists PHP Group as the vendor. No specific PHP version numbers are provided, so any PHP build that includes these filters and has not been patched may be vulnerable.

The CVSS score of 5.9 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit would require the ability to supply a line-break-chars value containing a NUL byte to a PHP script that uses these stream filters. The likely attack vector is through web applications or scripts run under the PHP interpreter that accept user-provided input for the line-back-chars option. If an attacker controls that option, they can read adjacent heap memory; however, there is no known remote code execution or privilege escalation.