This vulnerability involves an out-of-bounds read (CWE-125) in the PHP HTTP stream wrapper when processing redirects. Specifically, if a redirect response contains a Location header with an empty value, the code reads one byte beyond the allocated heap buffer for the location string. The value of this out-of-bounds byte determines the redirect target constructed by the client, allowing a malicious server to influence the redirect destination between the host root or the current directory.

An attacker controlling a malicious server can manipulate the redirect target of a PHP client by exploiting the out-of-bounds read. This can cause the client to be redirected to unintended locations, potentially leading to security issues such as redirect-based attacks or information disclosure depending on the context of use. The confidentiality impact is low, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should be cautious when handling redirects from untrusted sources in PHP HTTP stream wrappers.