CVE-2025-14177

published 2025-12-27

CVE-2025-14177: In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak…

medium 6.3 CVSS 4.0

AV N AC H AT P PR N UI N VC L VI N VA N SC L SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	php7.4	< php8.2 8.2.30-1~deb12u1 (bookworm)	php8.2 8.2.30-1~deb12u1 (bookworm)
debian	php8.2	< php8.2 8.2.30-1~deb12u1 (bookworm)	php8.2 8.2.30-1~deb12u1 (bookworm)
debian	php8.4	< php8.2 8.2.30-1~deb12u1 (bookworm)	php8.2 8.2.30-1~deb12u1 (bookworm)
msrc	azl3_php_8.3.23-1_on_azure_linux_3.0	—	—
msrc	azl3_php_8.3.29-1_on_azure_linux_3.0	—	—
msrc	cbl2_php_8.1.33-1_on_cbl_mariner_2.0	—	—
php	php	—	—
php	php	>= 8.1.0 < 8.1.34	8.1.34
php	php	>= 8.2.0 < 8.2.30	8.2.30
php	php	>= 8.3.0 < 8.3.29	8.3.29
php	php	>= 8.4.0 < 8.4.16	8.4.16
php_group	php	>= 8.1.* < 8.1.34	8.1.34
php_group	php	>= 8.2.* < 8.2.30	8.2.30
php_group	php	>= 8.3.* < 8.3.29	8.3.29
php_group	php	>= 8.4.* < 8.4.16	8.4.16
php_group	php	>= 8.5.* < 8.5.1	8.5.1

CVSS provenance

nvd v4.0 6.3 MEDIUM CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 6.3 MEDIUM

CWE-125