CVE-2025-14177

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php:8.5.0:::::::*

History

13 Oct 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) En versiones de PHP: 8.1.* anteriores a 8.1.34, 8.2.* anteriores a 8.2.30, 8.3.* anteriores a 8.3.29, 8.4.* anteriores a 8.4.16, 8.5.* anteriores a 8.5.1, la función getimagesize() puede filtrar memoria de pila no inicializada en los segmentos APPn (por ejemplo, APP1) al leer imágenes en modo de múltiples fragmentos (como a través de php://filter). Esto ocurre debido a un error en php_read_stream_all_chunks() que sobrescribe el búfer sin avanzar el puntero, dejando bytes de cola no inicializados. Esto puede llevar a la revelación de información de datos sensibles de la pila y afectar la confidencialidad del servidor objetivo.

Information

Published : 2025-12-27 20:15

Updated : 2026-10-13 09:10

NVD link : CVE-2025-14177

Mitre link : CVE-2025-14177

CVE.ORG link : CVE-2025-14177

JSON object : View

Products Affected

php

php

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2025-14177", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14177", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-29T16:01:25.714908Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@php.net", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@php.net", "affectedData": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.1.*", "lessThan": "8.1.34", "versionType": "semver"}, {"status": "affected", "version": "8.2.*", "lessThan": "8.2.30", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.29", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.16", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.1", "versionType": "semver"}], "packageName": "php", "defaultStatus": "affected"}]}], "published": "2025-12-27T20:15:40.400", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7", "tags": ["Exploit", "Third Party Advisory"], "source": "security@php.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@php.net", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server."}, {"lang": "es", "value": "En versiones de PHP: 8.1.* anteriores a 8.1.34, 8.2.* anteriores a 8.2.30, 8.3.* anteriores a 8.3.29, 8.4.* anteriores a 8.4.16, 8.5.* anteriores a 8.5.1, la funci\u00f3n getimagesize() puede filtrar memoria de pila no inicializada en los segmentos APPn (por ejemplo, APP1) al leer im\u00e1genes en modo de m\u00faltiples fragmentos (como a trav\u00e9s de php://filter). Esto ocurre debido a un error en php_read_stream_all_chunks() que sobrescribe el b\u00fafer sin avanzar el puntero, dejando bytes de cola no inicializados. Esto puede llevar a la revelaci\u00f3n de informaci\u00f3n de datos sensibles de la pila y afectar la confidencialidad del servidor objetivo."}], "lastModified": "2026-10-13T09:10:00.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56FCF002-3946-40DF-A774-75C6DDE6CA26", "versionEndExcluding": "8.1.34", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB314013-4F2F-40F0-968B-35FEC22CC8A4", "versionEndExcluding": "8.2.30", "versionStartIncluding": "8.2.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAD5402D-688D-44AA-B083-5157FDC53D7A", "versionEndExcluding": "8.3.29", "versionStartIncluding": "8.3.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8813328B-AC06-4060-916F-CD27144F41E2", "versionEndExcluding": "8.4.16", "versionStartIncluding": "8.4.0"}, {"criteria": "cpe:2.3:a:php:php:8.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7465128-DC9D-49F2-BFC2-6B307D7BC373"}], "operator": "OR"}]}], "sourceIdentifier": "security@php.net"}