The vulnerability exists in the php_openssl_matches_wildcard_name() function within ext/openssl/xp_ssl.c of PHP. When a TLS server certificate presents a wildcard name whose literal characters exceed the length of the hostname being verified, the length argument passed to memchr() underflows. This leads to reading up to SIZE_MAX bytes past the end of a heap allocation, causing a heap-based buffer overflow. The flaw is exploitable via any default client stream due to verify_peer_name being enabled by default.

An attacker controlling a malicious TLS server can present a specially crafted certificate with an overly long wildcard name, triggering a heap-based buffer overflow in the PHP client. This could lead to memory corruption and potentially impact confidentiality by reading unintended memory. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the PHP Group vendor advisory for current remediation guidance. Until a fix is available, consider disabling peer name verification in client streams if feasible, though this reduces security. Monitor official PHP security channels for updates and patches addressing this vulnerability.