CVE-2025-14180: CWE-476 NULL Pointer Dereference in PHP Group PHP
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
CVE-2025-14180: CWE-476 NULL Pointer Dereference in PHP Group PHP
Description
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- php
- Date Reserved
- 2025-12-06T06:43:11.174Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 695034b991db97df3a06a741
Added to database: 12/27/2025, 7:34:17 PM
Last updated: 12/27/2025, 9:41:33 PM
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
CVE-2025-14177: CWE-125 Out-of-bounds Read in PHP Group PHP
MediumCVE-2025-14178: CWE-787 Out-of-bounds Write in PHP Group PHP
MediumCVE-2025-15109: Unrestricted Upload in jackq XCMS
MediumCVE-2025-15108: Use of Hard-coded Cryptographic Key in PandaXGO PandaX
MediumCVE-2025-54322: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in Xspeeder SXZOS
CriticalActions
External Links
Need more coverage?
Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.