CVE-2026-14355: In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL…

PriorityP430medium5.3CVSS 3.1

AVNACLPRNUINSUCNINAL

EPSS

0.31%

22.6th percentile

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
php	php	>= 8.2.0 < 8.2.32	8.2.32
php	php	>= 8.3.0 < 8.3.32	8.3.32
php	php	>= 8.4.0 < 8.4.23	8.4.23
php	php	>= 8.5.0 < 8.5.8	8.5.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.