CVE-2025-14177
published 2025-12-27CVE-2025-14177: In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.52%
42.1th percentile
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php8.2 8.2.30-1~deb12u1 (bookworm) | php8.2 8.2.30-1~deb12u1 (bookworm) |
| debian | php8.2 | < php8.2 8.2.30-1~deb12u1 (bookworm) | php8.2 8.2.30-1~deb12u1 (bookworm) |
| debian | php8.4 | < php8.2 8.2.30-1~deb12u1 (bookworm) | php8.2 8.2.30-1~deb12u1 (bookworm) |
| msrc | azl3_php_8.3.23-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.29-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.33-1_on_cbl_mariner_2.0 | — | — |
| php | php | — | — |
| php | php | >= 8.1.0 < 8.1.34 | 8.1.34 |
| php | php | >= 8.2.0 < 8.2.30 | 8.2.30 |
| php | php | >= 8.3.0 < 8.3.29 | 8.3.29 |
| php | php | >= 8.4.0 < 8.4.16 | 8.4.16 |
| php_group | php | >= 8.1.* < 8.1.34 | 8.1.34 |
| php_group | php | >= 8.2.* < 8.2.30 | 8.2.30 |
| php_group | php | >= 8.3.* < 8.3.29 | 8.3.29 |
| php_group | php | >= 8.4.* < 8.4.16 | 8.4.16 |
| php_group | php | >= 8.5.* < 8.5.1 | 8.5.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.3MEDIUM
vendor_ubuntu7.5HIGH
vendor_debian6.3LOW
vendor_redhat6.3MEDIUM
vendor_msrc3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-01-12·CVSS 7.5
CVE-2025-14180 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled memory while reading images
in multi-chunk mode. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 24.04 LTS, Ubuntu
25.04 and Ubuntu 25.10. (CVE-2025-14177)
It was discovered that PHP incorrectly handled memory when element count
exceeds 32-bit limit. An attacker could possibly use this issue to cause
a denial of service. (CVE-2025-14178)
It was discovered that PHP incorrectly handled memory when using the PDO
PostgreSQL driver. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-14180
Red Hat
php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images
vendor_redhat·2025-12-27·CVSS 6.3
CVE-2025-14177 [MEDIUM] CWE-125 php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images
php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
A flaw was found in PHP. The getimagesize() function may leak uninitialized heap memory when processing images in multi-chunk mode, such as through php:/
Microsoft
Information Leak of Memory in getimagesize
vendor_msrc·2025-12-09·CVSS 3.7
CVE-2025-14177 [MEDIUM] CWE-125 Information Leak of Memory in getimagesize
Information Leak of Memory in getimagesize
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2025-14177: php7.4 - In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8...
vendor_debian·2025·CVSS 6.3
CVE-2025-14177 [MEDIUM] CVE-2025-14177: php7.4 - In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8...
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
Scope: local
bullseye: resolved
OSV
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
osv·2026-01-12·CVSS 6.3
CVE-2025-14177 [MEDIUM] php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
It was discovered that PHP incorrectly handled memory while reading images
in multi-chunk mode. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 24.04 LTS, Ubuntu
25.04 and Ubuntu 25.10. (CVE-2025-14177)
It was discovered that PHP incorrectly handled memory when element count
exceeds 32-bit limit. An attacker could possibly use this issue to cause
a denial of service. (CVE-2025-14178)
It was discovered that PHP incorrectly handled memory when using the PDO
PostgreSQL driver. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-14180)
OSV
CVE-2025-14177: In PHP versions:8
osv·2025-12-27·CVSS 6.3
CVE-2025-14177 [MEDIUM] CVE-2025-14177: In PHP versions:8
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
blogs_hackernews·2026-05-18·CVSS 6.1
CVE-2026-42897 [MEDIUM] ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
Monday opens with a trust problem. A mail server flaw is under active use. A network control system was targeted. Trusted packages were poisoned. A fake model page pushed a stealer. Then came the familiar ransom claim: the data was returned and deleted.
The pattern is clear. One weak dependency can leak keys. One leaked key can open cloud access. One cloud foothold can become a production incident. AI is speeding up vulnerability discovery, attackers are moving quickly, and old exposure still keeps paying off.
Patch the quiet risks first. Let’s g
Wiz
CVE-2025-14177 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2025-14177 [MEDIUM] CVE-2025-14177 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-14177 :
PHP vulnerability analysis and mitigation
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
Source : NVD
## 6.3
Score
Published December 27, 2025
Severity MEDIUM
CNA Score 6.3
Affected Technologies
PHP
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
C
Bugzilla
CVE-2025-14177 php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images
bugzilla·2025-12-27·CVSS 7.5
CVE-2025-14177 [HIGH] CVE-2025-14177 php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images
CVE-2025-14177 php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:1412 https://access.redha
2025-12-27
Published