UpHeron
All vulnerabilities

Servers and applications

CVE-2025-14180

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in…

Severity
High 8.2
Published
27 Dec 2025
Last changed
13 Oct 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.1.0 before 8.1.34
  • From 8.2.0 before 8.2.30
  • From 8.3.0 before 8.3.29
  • From 8.4.0 before 8.4.16
  • From 8.5.0 before 8.5.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-14180
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14180