---
id: CVE-2026-14355
title: >-
  In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23,
  8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL
  extension contains a buffer allocation flaw
summary: >-
  In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23,
  8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL
  extension contains a buffer allocation flaw. The output buffer for the AES
  key-wrap-w…
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-122
published: '2026-07-03'
updated: '2026-07-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14355'
references:
  - url: 'https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr'
    label: security@php.net
tags:
  - nvd
ingestedAt: '2026-07-04T11:56:06.586Z'
epss: 0.00279
epssPercentile: 0.18082
---

## Overview

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.