The vulnerability in PHP's stream filters convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode involves improper handling of the line-break-chars option. The length of this option is tracked independently from the string data. The duplication function pestrdup() truncates at the first NUL byte but keeps the original length, causing a mismatch. When the filter emits a line break, it copies data based on the recorded length, reading beyond the allocated buffer and including adjacent heap memory in the output. This is a heap-based buffer overflow (CWE-122) with related out-of-bounds read (CWE-125).

This vulnerability can lead to disclosure of adjacent heap memory contents through the filter output, potentially exposing sensitive information. The CVSS score of 5.9 indicates a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact on confidentiality only. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor PHP Group advisories for updates and apply patches once available.