CVE-2025-14177

Published Dec 27, 2025

Last updated 5 months ago

PHP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-14177 is an information disclosure vulnerability found in multiple versions of PHP, specifically within the `getimagesize()` function. The flaw occurs when this function processes images in multi-chunk mode, such as through `php://filter`. The root cause is a bug in the `php_read_stream_all_chunks()` function, where the buffer is overwritten without the pointer advancing, leaving certain tail bytes uninitialized. This can lead to the leakage of uninitialized heap memory into APPn segments (e.g., APP1) of the image, potentially exposing sensitive data from the server's memory.

Description: In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
Source: security@php.net
NVD status: Analyzed
Products: php

Risk scores

CVSS 4.0

Type: Secondary
Base score: 6.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security@php.net: CWE-125

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "56FCF002-3946-40DF-A774-75C6DDE6CA26",
            "versionEndExcluding": "8.1.34",
            "versionStartIncluding": "8.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AB314013-4F2F-40F0-968B-35FEC22CC8A4",
            "versionEndExcluding": "8.2.30",
            "versionStartIncluding": "8.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "DAD5402D-688D-44AA-B083-5157FDC53D7A",
            "versionEndExcluding": "8.3.29",
            "versionStartIncluding": "8.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8813328B-AC06-4060-916F-CD27144F41E2",
            "versionEndExcluding": "8.4.16",
            "versionStartIncluding": "8.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:8.5.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "F7465128-DC9D-49F2-BFC2-6B307D7BC373",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.