This vulnerability arises from the use of signed char values passed to ctype functions in PHP, which on some systems with specific ctype implementations can result in out-of-bounds reads due to negative array indexing. Affected PHP versions include 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. The issue can trigger denial of service conditions but does not indicate code execution or data disclosure. The CVSS 4.0 score is 6.3, reflecting a medium severity with network attack vector and high attack complexity.

The vulnerability can cause denial of service on affected PHP versions running on systems with default signed char and optimized ctype functions, such as NetBSD. There is no indication of privilege escalation, data corruption, or remote code execution. No known active exploitation has been reported.

Patch status is not yet confirmed — check the PHP Group vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications and consider mitigating exposure on affected systems, especially those running on NetBSD or similar environments. No vendor advisory or patch links are currently available.