CVE-2025-14177

Description

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

How to fix CVE-2025-14177

To remediate CVE-2025-14177, upgrade the affected package to a fixed version below.

• —upgrade to 8.1.34 or later
• —upgrade to 8.1.34 or later
• —upgrade to 8.1.34 or later
• —upgrade to 8.2.30-1~deb12u1 or later
• —upgrade to 8.2.30-1~deb12u1 or later
• —upgrade to 8.4.16-1~deb13u1 or later
• —upgrade to 8.4.16-1~deb13u1 or later

Is CVE-2025-14177 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 8.1.34, >= 8.2.0, < 8.2.30, >= 8.3.0, < 8.3.29, >= 8.4.0, < 8.4.16, >= 8.5.0, < 8.5.1
• from 0, < 8.1.34, >= 8.2.0, < 8.2.30, >= 8.3.0, < 8.3.29, >= 8.4.0, < 8.4.16, >= 8.5.0, < 8.5.1
• from 0, < 8.1.34, >= 8.2.0, < 8.2.30, >= 8.3.0, < 8.3.29, >= 8.4.0, < 8.4.16, >= 8.5.0, < 8.5.1
• from 0, < 8.2.30-1~deb12u1
• from 0, < 8.2.30-1~deb12u1
• from 0, < 8.4.16-1~deb13u1
• from 0, < 8.4.16-1~deb13u1

CVSS scores

References (3)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-14177
• WEBgithub.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7
• WEBnvd.nist.gov/vuln/detail/CVE-2025-14177