{"id":"CVE-2025-14177","title":"In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading image…","summary":"In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading image…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-125"],"vendor":"php","product":"php","affected":["php >= 8.1.0, < 8.1.34","php >= 8.2.0, < 8.2.30","php >= 8.3.0, < 8.3.29","php >= 8.4.0, < 8.4.16","php = 8.5.0"],"patched":["php 8.4.16"],"published":"2025-12-27","updated":"2026-10-13","sourceUpdated":"2026-10-13T09:10:00.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-14177","references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7","label":"security@php.net"}],"tags":["nvd","exploit-available"],"epss":0.00508,"epssPercentile":0.41675,"exploits":{"github":2,"githubRepos":["https://github.com/gl1tch0x1/PHP_8.1.x_Exploit","https://github.com/34zY/CVE-2025-14177"],"checkedAt":"2026-10-13T09:20:57.861Z"},"exploitAvailable":true,"ingestedAt":"2026-10-13T09:20:23.161Z","slug":"CVE-2025-14177","body":"## Overview\n\nIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.\n\n## Affected\n\n- `php >= 8.1.0, < 8.1.34`\n- `php >= 8.2.0, < 8.2.30`\n- `php >= 8.3.0, < 8.3.29`\n- `php >= 8.4.0, < 8.4.16`\n- `php = 8.5.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `php 8.4.16`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}