CVE-2025-14177

EUVD-2025-205484

27.12.2025, 20:15

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 23%

Affected Products (NVD)

Vendor	Product	Version
php	php	8.1.0 ≤ 𝑥 < 8.1.34
php	php	8.2.0 ≤ 𝑥 < 8.2.30
php	php	8.3.0 ≤ 𝑥 < 8.3.29
php	php	8.4.0 ≤ 𝑥 < 8.4.16
php	php	8.5.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

php7.4

bullseye	7.4.33-1+deb11u5 fixed
bullseye (security)	7.4.33-1+deb11u11 fixed

php8.2

bookworm	8.2.31-1~deb12u1 fixed
bookworm (security)	8.2.31-1~deb12u1 fixed

php8.4

forky	8.4.21-1 fixed
sid	8.4.21-1 fixed
trixie	8.4.16-1~deb13u1 fixed
trixie (security)	8.4.21-1~deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

php5

jammy	dne
noble	dne
plucky	dne
questing	dne
trusty	not-affected

php7.0

jammy	dne
noble	dne
plucky	dne
questing	dne
xenial	not-affected

php7.2

bionic	not-affected
jammy	dne
noble	dne
plucky	dne
questing	dne

php7.4

focal	not-affected
jammy	dne
noble	dne
plucky	dne
questing	dne

php8.1

jammy	not-affected
noble	dne
plucky	dne
questing	dne

php8.3

jammy	dne
noble	Fixed 8.3.6-0ubuntu0.24.04.6 released
plucky	dne
questing	dne

php8.4

jammy	dne
noble	dne
plucky	Fixed 8.4.5-1ubuntu1.2 released
questing	Fixed 8.4.11-1ubuntu1.1 released

openSUSE / SLES Releases

openSUSE Product

Release

apache2-mod_php8

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-bcmath

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-bz2

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-calendar

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-cli

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-ctype

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-curl

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-dba

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-devel

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-dom

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-embed

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-enchant

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-exif

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-fastcgi

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-fileinfo

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-fpm

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-ftp

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-gd

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-gettext

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-gmp

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-iconv

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-intl

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-ldap

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-mbstring

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-mysql

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-odbc

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-opcache

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-openssl

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-pcntl

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-pdo

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-pgsql

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-phar

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-posix

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-readline

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-shmop

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-snmp

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-soap

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-sockets

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-sodium

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-sqlite

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-sysvmsg

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-sysvsem

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-sysvshm

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-test

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-tidy

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-tokenizer

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-xmlreader

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-xmlwriter

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-xsl

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-zip

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

php8-zlib

suse enterprise sap 15 SP7	8.3.29-150700.3.9.1 fixed
suse enterprise server 15 SP7	8.3.29-150700.3.9.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

php

RHEL 9

0:8.0.30-5.el9_7

fixed

php-bcmath

RHEL 9

0:8.0.30-5.el9_7

fixed

php-cli

RHEL 9

0:8.0.30-5.el9_7

fixed

php-common

RHEL 9

0:8.0.30-5.el9_7

fixed

php-dba

RHEL 9

0:8.0.30-5.el9_7

fixed

php-dbg

RHEL 9

0:8.0.30-5.el9_7

fixed

php-devel

RHEL 9

0:8.0.30-5.el9_7

fixed

php-embedded

RHEL 9

0:8.0.30-5.el9_7

fixed

php-enchant

RHEL 9

0:8.0.30-5.el9_7

fixed

php-ffi

RHEL 9

0:8.0.30-5.el9_7

fixed

php-fpm

RHEL 9

0:8.0.30-5.el9_7

fixed

php-gd

RHEL 9

0:8.0.30-5.el9_7

fixed

php-gmp

RHEL 9

0:8.0.30-5.el9_7

fixed

php-intl

RHEL 9

0:8.0.30-5.el9_7

fixed

php-ldap

RHEL 9

0:8.0.30-5.el9_7

fixed

php-mbstring

RHEL 9

0:8.0.30-5.el9_7

fixed

php-mysqlnd

RHEL 9

0:8.0.30-5.el9_7

fixed

php-odbc

RHEL 9

0:8.0.30-5.el9_7

fixed

php-opcache

RHEL 9

0:8.0.30-5.el9_7

fixed

php-pdo

RHEL 9

0:8.0.30-5.el9_7

fixed

php-pgsql

RHEL 9

0:8.0.30-5.el9_7

fixed

php-process

RHEL 9

0:8.0.30-5.el9_7

fixed

php-snmp

RHEL 9

0:8.0.30-5.el9_7

fixed

php-soap

RHEL 9

0:8.0.30-5.el9_7

fixed

php-xml

RHEL 9

0:8.0.30-5.el9_7

fixed

Known Exploits!

https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

Vulnerability Media Exposure

[ENGLISH] ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
Monday opens with a trust problem. A mail server flaw is under active use. A network control system was targeted. Trusted packages were poisoned. A fake model page pushed a stealer. Then came the familiar ransom claim: the data was returned and deleted. The pattern is clear. One weak dependency can leak keys. One leaked key can open cloud access. One cloud foothold can become a production
Published: 2026-05-18T19:20:17+05:30

References

https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7