This vulnerability arises from a mismatch between encoding lists used by Oniguruma and mbfl libraries in certain PHP versions, leading to a NULL pointer dereference. When user input controls the encoding parameter passed to mb_regex_encoding(), it can cause a segmentation fault resulting in denial of service. The affected PHP versions are 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. The CVSS 4.0 base score is 2.1, indicating low severity. There is no vendor advisory or patch information currently available to confirm remediation status.

The vulnerability can cause a denial of service via segmentation fault when exploited, impacting availability of PHP applications running affected versions. There is no indication of privilege escalation, data confidentiality loss, or integrity compromise. Exploitation requires user-controlled input to influence encoding passed to mb_regex_encoding(). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or validating user input that influences mb_regex_encoding() to prevent triggering the NULL pointer dereference. Monitor official PHP Group communications for updates on patches or workarounds.