Null Byte Interaction Error (Poison Null Byte)

This vulnerability occurs when software incorrectly processes null bytes (NUL characters) as data moves between different systems or programming languages, leading to unexpected and potentially dangerous behavior.

A null byte (\0) has different meanings across programming environments. In languages like C and C++, it marks the definitive end of a string. However, in higher-level languages like PHP, Perl, or Python, a null byte is treated as just another character within the string. The security risk emerges when data from these languages passes into underlying C-based functions or system calls, where the null byte suddenly becomes a terminator. This mismatch can truncate data, bypass filters, and create openings for attackers to manipulate how the application processes information. Attackers frequently exploit this discrepancy in path traversal attacks. By injecting a null byte into a filename (e.g., 'malicious.exe\0.txt'), they can terminate a hard-coded file extension appended by the application, causing the system to process a dangerous file type. This technique can also interfere with security checks, input validation, and regular expression parsing, making it a critical issue for web applications and software that bridges multiple language layers.