CVE-2025-14180
published 2025-12-27CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.71%
51.1th percentile
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php8.2 8.2.30-1~deb12u1 (bookworm) | php8.2 8.2.30-1~deb12u1 (bookworm) |
| debian | php8.2 | < php8.2 8.2.30-1~deb12u1 (bookworm) | php8.2 8.2.30-1~deb12u1 (bookworm) |
| debian | php8.4 | < php8.2 8.2.30-1~deb12u1 (bookworm) | php8.2 8.2.30-1~deb12u1 (bookworm) |
| msrc | azl3_php_8.3.23-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.29-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.33-1_on_cbl_mariner_2.0 | — | — |
| php | php | >= 8.1.0 < 8.1.34 | 8.1.34 |
| php | php | >= 8.2.0 < 8.2.30 | 8.2.30 |
| php | php | >= 8.3.0 < 8.3.29 | 8.3.29 |
| php | php | >= 8.4.0 < 8.4.16 | 8.4.16 |
| php | php | >= 8.5.0 < 8.5.1 | 8.5.1 |
| php_group | php | >= 8.1.* < 8.1.34 | 8.1.34 |
| php_group | php | >= 8.2.* < 8.2.30 | 8.2.30 |
| php_group | php | >= 8.3.* < 8.3.29 | 8.3.29 |
| php_group | php | >= 8.4.* < 8.4.16 | 8.4.16 |
| php_group | php | >= 8.5.* < 8.5.1 | 8.5.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.2HIGH
vendor_debian8.2LOW
vendor_redhat8.2HIGH
vendor_ubuntu7.5HIGH
vendor_msrc5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-01-12·CVSS 7.5
CVE-2025-14180 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled memory while reading images
in multi-chunk mode. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 24.04 LTS, Ubuntu
25.04 and Ubuntu 25.10. (CVE-2025-14177)
It was discovered that PHP incorrectly handled memory when element count
exceeds 32-bit limit. An attacker could possibly use this issue to cause
a denial of service. (CVE-2025-14178)
It was discovered that PHP incorrectly handled memory when using the PDO
PostgreSQL driver. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-14180
Red Hat
php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
vendor_redhat·2025-12-27·CVSS 8.2
CVE-2025-14180 [HIGH] CWE-476 php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
A flaw was found in PHP. When the PDO (PHP Data Objects) PostgreSQL driver is configured with `PDO::ATTR_EMULATE_PREPARES` enabled, a remote attacker can exploit a vulnerability by providing an
Microsoft
NULL Pointer Dereference in PDO quoting
vendor_msrc·2025-12-09·CVSS 5.9
CVE-2025-14180 [HIGH] CWE-476 NULL Pointer Dereference in PDO quoting
NULL Pointer Dereference in PDO quoting
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2025-14180: php7.4 - In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8...
vendor_debian·2025·CVSS 8.2
CVE-2025-14180 [HIGH] CVE-2025-14180: php7.4 - In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8...
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Scope: local
bullseye: resolved
OSV
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
osv·2026-01-12·CVSS 6.3
CVE-2025-14177 [MEDIUM] php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
It was discovered that PHP incorrectly handled memory while reading images
in multi-chunk mode. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 24.04 LTS, Ubuntu
25.04 and Ubuntu 25.10. (CVE-2025-14177)
It was discovered that PHP incorrectly handled memory when element count
exceeds 32-bit limit. An attacker could possibly use this issue to cause
a denial of service. (CVE-2025-14178)
It was discovered that PHP incorrectly handled memory when using the PDO
PostgreSQL driver. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-14180)
OSV
CVE-2025-14180: In PHP versions 8
osv·2025-12-27·CVSS 8.2
CVE-2025-14180 [HIGH] CVE-2025-14180: In PHP versions 8
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-14180 php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
bugzilla·2025-12-27·CVSS 8.2
CVE-2025-14180 [HIGH] CVE-2025-14180 php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
CVE-2025-14180 php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.4 Extended Update Support
Via RHSA-2026:1169 https://access.redhat.com/errata/RH
Hackernews
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
blogs_hackernews·2026-07-13
CVE-2026-50746 ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.
That's the shape of this week. Trusted code turns on the people who installed it. Old bugs from last year are still landing because the fix sat in a queue too long. Fake installers, poisoned packages, systems left facing the open internet, and helpful little AI assistants running instructions that were
Wiz
CVE-2025-14180 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2025-14180 [HIGH] CVE-2025-14180 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-14180 :
PHP vulnerability analysis and mitigation
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Source : NVD
## 8.2
Score
Published December 27, 2025
Severity HIGH
CNA Score 8.2
Affected Technologies
PHP
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/
2025-12-27
Published