UpHeron
All vulnerabilities

Servers and applications

CVE-2025-14177

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the…

Severity
Medium 6.3
Published
27 Dec 2025
Last changed
13 Oct 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.1.34, 8.2.30, 8.3.29, 8.4.16
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.1.0 before 8.1.34
  • From 8.2.0 before 8.2.30
  • From 8.3.0 before 8.3.29
  • From 8.4.0 before 8.4.16
  • Version 8.5.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-14177
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14177