Php: Information Leak of Memory in getimagesize (CVE-2025-14177)
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
AI Analysis
Technical Summary
The vulnerability (CVE-2025-14180) exists in PHP when using the PDO PostgreSQL driver with the PDO::ATTR_EMULATE_PREPARES option enabled. An attacker can supply an invalid character sequence within a prepared statement parameter, causing a null pointer dereference and resulting in a server crash (denial of service). This issue affects Red Hat Hardened Images PHP RPMs version 8.5.5-1.1.hum1 for aarch64 and x86_64 architectures. Red Hat rates this vulnerability as Important due to its potential to disrupt availability. No official fix or mitigation is currently available. The vulnerability is tracked under Red Hat advisory RHSA-2026:1429 and is associated with CWE-476 (NULL Pointer Dereference).
Potential Impact
The primary impact is a denial of service condition caused by a null pointer dereference leading to a server crash. This affects availability of PHP applications using the vulnerable PDO PostgreSQL driver configuration. There is no confidentiality or integrity impact reported. Exploitation requires the PDO::ATTR_EMULATE_PREPARES option to be explicitly enabled. No known exploits are reported in the wild.
Mitigation Recommendations
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and apply any future patches when released. Until then, consider disabling PDO::ATTR_EMULATE_PREPARES if feasible to reduce exposure.
Php: Information Leak of Memory in getimagesize (CVE-2025-14177)
Description
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
Affected software
pkg:bitnami/phpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2025-14180) exists in PHP when using the PDO PostgreSQL driver with the PDO::ATTR_EMULATE_PREPARES option enabled. An attacker can supply an invalid character sequence within a prepared statement parameter, causing a null pointer dereference and resulting in a server crash (denial of service). This issue affects Red Hat Hardened Images PHP RPMs version 8.5.5-1.1.hum1 for aarch64 and x86_64 architectures. Red Hat rates this vulnerability as Important due to its potential to disrupt availability. No official fix or mitigation is currently available. The vulnerability is tracked under Red Hat advisory RHSA-2026:1429 and is associated with CWE-476 (NULL Pointer Dereference).
Potential Impact
The primary impact is a denial of service condition caused by a null pointer dereference leading to a server crash. This affects availability of PHP applications using the vulnerable PDO PostgreSQL driver configuration. There is no confidentiality or integrity impact reported. Exploitation requires the PDO::ATTR_EMULATE_PREPARES option to be explicitly enabled. No known exploits are reported in the wild.
Mitigation Recommendations
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and apply any future patches when released. Until then, consider disabling PDO::ATTR_EMULATE_PREPARES if feasible to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:1429
- Cve Count
- 3
- Additional Cves
- ["CVE-2025-14178","CVE-2025-14180"]
- State
- PUBLISHED
Threat ID: 6a248d78e29bf47b50d6578e
Added to database: 06/06/2026, 21:13:28 UTC
Last enriched: 08/16/2026, 17:50:54 UTC
Last updated: 09/14/2026, 10:01:26 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.