An out-of-bounds read occurs when PHP's HTTP stream wrapper follows a redirect whose Location header is empty. The code reads one byte past the end of the buffer storing the location value, and that byte determines whether the client is redirected to the host root or to the current directory. This allows an attacker to influence a client's navigation path without modifying the requested URL, potentially enabling phishing or other malicious content delivery. The weakness is a classic misuse of buffer bounds, identified as CWE-125, and does not lead to code execution or privilege escalation on its own.

The vulnerability affects PHP releases distributed by the PHP Group for the PHP language. No specific version numbers are listed in the advisory, so the impact applies to all affected PHP builds until the bug is fixed in a newer release.

The CVSS score of 5.8 indicates moderate severity; the EPSS score is unavailable, and the vulnerability is not listed on CISA KEV. The likely attack vector is remote: an attacker can serve a crafted HTTP response with an empty Location header to any PHP-enabled application that follows redirects. Without a patch, the attacker can subvert user navigation, but the potential for broader compromise is limited to the mild impact on redirection control.