High 7.5 CVSS 3.1 PHP Published on 2025-12-27

In PHP versions:8.1. before 8.1.34, 8.2.

CVECVE-2025-14177 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-10-13

Description

In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security@php.net · secondary

High 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vectorNetwork

ComplexityHigh

Attack requirementsPresent

Privileges requiredNone

User interactionNone

Confidentiality (system)Low

Integrity (system)None

Availability (system)None

Confidentiality (others)Low

Integrity (others)None

Availability (others)None

References

Exploitgithub.com
https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

PHP (29)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2026-109619 PHP has various global state that temporarily points into request memory. PHP Critical 9.2 ≥ 5.4.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No

CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. PHP Critical 9.8 ≥ 7.3.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No

CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. PHP High 7.5 ≥ 8.2.0 < 8.2.34
≥ 8.3.0 < 8.3.35
≥ 8.4.0 < 8.4.26
+1 2026-09-25 No

CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP… PHP Critical 9.8 ≥ 8.4.0 < 8.4.24
≥ 8.5.0 < 8.5.9 2026-07-30 No

Does your server run PHP 8.1.x ≥ 8.1.0 < 8.1.34, 8.2.x ≥ 8.2.0 < 8.2.30, 8.3.x ≥ 8.3.0 < 8.3.29, 8.4.x ≥ 8.4.0 < 8.4.16, 8.5.x = 8.5.0?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected