CVE-2025-14180

CWE-476 — NULL Pointer Dereference9 documents8 sources
Severity
8.2HIGH
EPSS
0.0%
top 89.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PHP Group PHPPHP PHP
Timeline
PublishedDec 27
Latest updateJan 12

Description

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target …

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDphp/php8.1.0 — 8.1.34+4
▶CVEListV5php_group/php8.1.* — 8.1.34+4
▶Debianphp8.2< 8.2.30-1~deb12u1
▶Debianphp8.4< 8.4.16-1~deb13u1+1

🔴Vulnerability Details

3
OSV
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities↗2026-01-12
▶
CVEList
NULL Pointer Dereference in PDO quoting↗2025-12-27
▶
OSV
CVE-2025-14180: In PHP versions 8↗2025-12-27
▶

📋Vendor Advisories

4
Ubuntu
PHP vulnerabilities↗2026-01-12
▶
Red Hat
php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement↗2025-12-27
▶
Microsoft
NULL Pointer Dereference in PDO quoting↗2025-12-09
▶
Debian
CVE-2025-14180: php7.4 - In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-14180 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶