diff --git a/NEWS b/NEWS
index f6ce584b6e7..4c96bab8f52 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-20631 (Integer underflow in exif HEIF parsing
     when pos.size < 2). (Oblivionsage)
 
+- Intl:
+  . Fix leak in umsg_format_helper(). (ndossche)
+
 - LDAP:
   . Fix memory leak in ldap_set_options(). (ndossche)
 
diff --git a/ext/intl/msgformat/msgformat_helpers.cpp b/ext/intl/msgformat/msgformat_helpers.cpp
index e734b2df27b..25e8dbf8696 100644
--- a/ext/intl/msgformat/msgformat_helpers.cpp
+++ b/ext/intl/msgformat/msgformat_helpers.cpp
@@ -455,6 +455,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 						char *message;
 						spprintf(&message, 0, "Invalid UTF-8 data in string argument: "
 							"'%s'", ZSTR_VAL(str));
+						zend_tmp_string_release(tmp_str);
 						intl_errors_set(&err, err.code, message);
 						efree(message);
 						delete text;
diff --git a/ext/intl/tests/msgfmt_format_error4.phpt b/ext/intl/tests/msgfmt_format_error4.phpt
index 451a55ad9da..78dc27b4092 100644
--- a/ext/intl/tests/msgfmt_format_error4.phpt
+++ b/ext/intl/tests/msgfmt_format_error4.phpt
@@ -25,9 +25,22 @@ try {
     var_dump($e::class === 'IntlException');
     var_dump("MessageFormatter::format(): Invalid UTF-8 data in string argument: '\x80'" ===  $e->getMessage());
 }
+
+try {
+    var_dump($mf->format(array("foo" => new class {
+        function __toString(): string {
+            return str_repeat("\x80", random_int(1, 1));
+        }
+    })));
+} catch (Throwable $e) {
+    var_dump($e::class === 'IntlException');
+    var_dump("MessageFormatter::format(): Invalid UTF-8 data in string argument: '\x80'" ===  $e->getMessage());
+}
 ?>
 --EXPECT--
 bool(true)
 bool(true)
 bool(true)
 bool(true)
+bool(true)
+bool(true)