CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv	Vendor Advisory
https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::

History

23 Oct 2026, 14:56

Type	Values Removed	Values Added
First Time		Php php Php
References	~~() https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv -~~	() https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv - Vendor Advisory
CPE		cpe:2.3:a:php:php::::::::

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El cliente SOAP HTTP protege el crecimiento de su búfer de respuesta con una comprobación que se basa en un desbordamiento de entero con signo, lo cual es un comportamiento indefinido y no se garantiza que se active. Cuando la comprobación se optimiza y elimina, un servidor SOAP malicioso puede hacer que el cliente asigne un búfer mucho más pequeño que los datos que luego escribe en él, produciendo un desbordamiento de búfer en el montón.

25 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 21:17

Updated : 2026-10-23 14:56

NVD link : CVE-2025-14181

Mitre link : CVE-2025-14181

CVE.ORG link : CVE-2025-14181

JSON object : View

Products Affected

php

php

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2025-14181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14181", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T20:43:53.478398Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@php.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@php.net", "affectedData": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver"}], "packageName": "ext-soap", "defaultStatus": "unaffected"}]}], "published": "2026-09-25T21:17:19.840", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv", "tags": ["Vendor Advisory"], "source": "security@php.net"}, {"url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@php.net", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}, {"lang": "es", "value": "El cliente SOAP HTTP protege el crecimiento de su b\u00fafer de respuesta con una comprobaci\u00f3n que se basa en un desbordamiento de entero con signo, lo cual es un comportamiento indefinido y no se garantiza que se active. Cuando la comprobaci\u00f3n se optimiza y elimina, un servidor SOAP malicioso puede hacer que el cliente asigne un b\u00fafer mucho m\u00e1s peque\u00f1o que los datos que luego escribe en \u00e9l, produciendo un desbordamiento de b\u00fafer en el mont\u00f3n."}], "lastModified": "2026-10-23T14:56:56.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAFB3643-4D71-46ED-8184-DDE5FE41CD02", "versionEndExcluding": "8.2.34", "versionStartIncluding": "8.2.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF664EE8-D417-45A4-84DF-158F5073FDE8", "versionEndExcluding": "8.3.35", "versionStartIncluding": "8.3.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52D4BECA-EF0D-4180-837C-AEFA7A12D243", "versionEndExcluding": "8.4.26", "versionStartIncluding": "8.4.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "308803C0-9FC8-40D2-8920-B83BCC48014F", "versionEndExcluding": "8.5.11", "versionStartIncluding": "8.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@php.net"}