---
id: CVE-2025-14180
title: >-
  In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29,
  8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver
  with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such
  as \…
summary: >-
  In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29,
  8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver
  with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such
  as \…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: php
product: php
affected:
  - 'php >= 8.1.0, < 8.1.34'
  - 'php >= 8.2.0, < 8.2.30'
  - 'php >= 8.3.0, < 8.3.29'
  - 'php >= 8.4.0, < 8.4.16'
  - 'php >= 8.5.0, < 8.5.1'
patched:
  - php 8.5.1
published: '2025-12-27'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14180'
references:
  - url: 'https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj'
    label: security@php.net
tags:
  - nvd
epss: 0.00697
epssPercentile: 0.51718
ingestedAt: '2026-10-13T09:20:23.162Z'
---

## Overview

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

## Affected

- `php >= 8.1.0, < 8.1.34`
- `php >= 8.2.0, < 8.2.30`
- `php >= 8.3.0, < 8.3.29`
- `php >= 8.4.0, < 8.4.16`
- `php >= 8.5.0, < 8.5.1`

## Remediation

Upgrade past the affected range:

- `php 8.5.1`