{"id":"CVE-2025-14180","title":"In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\…","summary":"In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"php","product":"php","affected":["php >= 8.1.0, < 8.1.34","php >= 8.2.0, < 8.2.30","php >= 8.3.0, < 8.3.29","php >= 8.4.0, < 8.4.16","php >= 8.5.0, < 8.5.1"],"patched":["php 8.5.1"],"published":"2025-12-27","updated":"2026-10-13","sourceUpdated":"2026-10-13T09:10:00.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-14180","references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj","label":"security@php.net"}],"tags":["nvd"],"epss":0.00697,"epssPercentile":0.51718,"ingestedAt":"2026-10-13T09:20:23.162Z","slug":"CVE-2025-14180","body":"## Overview\n\nIn PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.\n\n## Affected\n\n- `php >= 8.1.0, < 8.1.34`\n- `php >= 8.2.0, < 8.2.30`\n- `php >= 8.3.0, < 8.3.29`\n- `php >= 8.4.0, < 8.4.16`\n- `php >= 8.5.0, < 8.5.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `php 8.5.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}