Read the docs
TI-2025-12958 Aliases CVE-2025-14180

NULL Pointer Dereference in PDO quoting

Priority HIGH 69CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00697 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial PHP (PHP Group): 8.1.34, 8.2.30, 8.3.29 +2Red Hat: 10 advisoriesRed Hat: 8 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHPbefore 8.1.34; before 8.2.30; before 8.3.29; before 8.4.16; before 8.5.18.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1Patch availableCNA
  • PHP VendorPHP Group Affected before 8.1.34; before 8.2.30; before 8.3.29; before 8.4.16; before 8.5.1 Fixed in 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*8.1.0 to before 8.1.34; 8.2.0 to before 8.2.30; 8.3.0 to before 8.3.29; 8.4.0 to before 8.4.16; 8.5.0 to before 8.5.1VulnerablePHP
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 8.1.0 to before 8.1.34; 8.2.0 to before 8.2.30; 8.3.0 to before 8.3.29; 8.4.0 to before 8.4.16; 8.5.0 to before 8.5.1 Vulnerable ·PHP

Remediation

  • Fix · CNA PHP (PHP Group) Fixed in 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1

Red Hat 10 advisories

  • RHSA-2026:7614 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images php-8.5.5-1.1.hum1@aarch64, php-8.5.5-1.1.hum1@src, php-8.5.5-1.1.hum1@x86_64 +47
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:1628 Released 2026-02-02 · Red Hat rating Important
    php security update
    • Red Hat Enterprise Linux AppStream (v. 10) php-8.3.29-1.el10_1, php-bcmath-8.3.29-1.el10_1, php-cli-8.3.29-1.el10_1 +22
Show 7 more Red Hat advisories
  • RHSA-2026:1429 Released 2026-01-27 · Red Hat rating Important
    php:8.3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.29-1.module+el9.7.0+23852+76de6b03.aarch64::php:8.3, php-8.3.29-1.module+el9.7.0+23852+76de6b03.ppc64le::php:8.3 +47
  • RHSA-2026:1409 Released 2026-01-27 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.4.0+20748+b46899d2.noarch::php:8.2, php-8.2.30-1.module+el9.7.0+23849+7b831f17.aarch64::php:8.2, php-8.2.30-1.module+el9.7.0+23849+7b831f17.ppc64le::php:8.2 +47
  • RHSA-2026:1412 Released 2026-01-27 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.23-1.module+el8.10.0+20770+a5eca186.noarch::php:8.2, libzip-1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2, libzip-1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2 +47
  • RHSA-2026:1190 Released 2026-01-26 · Red Hat rating Important
    php:8.3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.19-1.module+el9.6.0+23891+2c64b922.2.aarch64::php:8.3, php-8.3.19-1.module+el9.6.0+23891+2c64b922.2.ppc64le::php:8.3 +47
  • RHSA-2026:1187 Released 2026-01-26 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) apcu-panel-5.1.23-1.module+el9.4.0+20748+b46899d2.noarch::php:8.2, php-8.2.28-1.module+el9.6.0+23892+f0eec4a0.2.aarch64::php:8.2, php-8.2.28-1.module+el9.6.0+23892+f0eec4a0.2.ppc64le::php:8.2 +47
  • RHSA-2026:1185 Released 2026-01-26 · Red Hat rating Important
    php security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) php-8.3.19-1.el10_0.1, php-bcmath-8.3.19-1.el10_0.1, php-cli-8.3.19-1.el10_0.1 +22
  • RHSA-2026:1169 Released 2026-01-26 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) apcu-panel-5.1.23-1.module+el9.4.0+20748+b46899d2.noarch::php:8.2, php-8.2.13-1.module+el9.4.0+23893+7c48bdfc.2.aarch64::php:8.2, php-8.2.13-1.module+el9.4.0+23893+7c48bdfc.2.ppc64le::php:8.2 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP 8.1.34, 8.2.30 and 3 more versions

    3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2025-12956 Heap buffer overflow in array_merge()Priority HIGH 69
    • TI-2025-12955 Information Leak of Memory in getimagesizePriority MEDIUM 61
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:1628
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:1412
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:1409, RHSA-2026:1429
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:1185
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:1169
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:1187, RHSA-2026:1190
Red Hat Hardened ImagesFixed RHSA-2026:7614
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Not affected: 5 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14180
  2. 2026-10-13 EPSS moved to the below the 50th percentile
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences