In PHP versions 8.4.* prior to 8.4.21 and 8.5.* prior to 8.5.6, the mbstring extension functions (including mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order()) improperly handle encoding names containing embedded NUL bytes. The vulnerability arises from an incorrect assumption that strncasecmp() returning 0 implies equal string length, which can cause an out-of-bounds read of global memory. This flaw can lead to application crashes or information disclosure. The issue also affects mbstring INI settings such as mbstring.detect_order and mbstring.http_output. Red Hat has issued security advisories and patches addressing this vulnerability in their PHP 8.4 packages.

Successful exploitation can cause out-of-bounds memory reads, potentially leading to application crashes or disclosure of sensitive information from global memory. The vulnerability affects PHP applications using mbstring functions with attacker-controlled encoding names containing embedded NUL bytes. The CVSS 4.0 base score is 6.3, indicating a medium severity impact with network attack vector, low complexity, and partial impact on confidentiality and availability.

A security update fixing this vulnerability is available in PHP versions 8.4.21 and 8.5.6. Users should upgrade affected PHP installations to these or later versions to remediate the issue. Red Hat has released updated PHP 8.4 packages addressing this vulnerability for Red Hat Enterprise Linux 10. No alternative mitigations are indicated in the vendor advisory.