Read the docs
TI-2025-12959 Aliases CVE-2025-14181

Integer overflow to buffer overflow in soap HTTP parsing

Priority MEDIUM 62CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 2 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Partial PHP (PHP Group): 8.2.34, 8.3.35, 8.4.26 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHPbefore 8.2.34; before 8.3.35; before 8.4.26; before 8.5.118.2.34, 8.3.35, 8.4.26, 8.5.11Patch availableCNA
  • PHP VendorPHP Group Affected before 8.2.34; before 8.3.35; before 8.4.26; before 8.5.11 Fixed in 8.2.34, 8.3.35, 8.4.26, 8.5.11 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*8.2.0 to before 8.2.34; 8.3.0 to before 8.3.35; 8.4.0 to before 8.4.26; 8.5.0 to before 8.5.11VulnerablePHP
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 8.2.0 to before 8.2.34; 8.3.0 to before 8.3.35; 8.4.0 to before 8.4.26; 8.5.0 to before 8.5.11 Vulnerable ·PHP

Remediation

  • Fix · CNA PHP (PHP Group) Fixed in 8.2.34, 8.3.35, 8.4.26, 8.5.11

Red Hat 2 advisories

  • RHSA-2026:87080 Released 2026-10-21 · Red Hat rating Important
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.10.0+22485+a3539972.noarch::php:7.4, libzip-1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4, libzip-1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4 +47
  • RHSA-2026:70720 Released 2026-09-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images php-8.5.11-2.hum1@aarch64, php-8.5.11-2.hum1@src, php-8.5.11-2.hum1@x86_64 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP 8.2.34, 8.3.35 and 2 more versions

    11 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2026-63096 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerPriority HIGH 65
    • TI-2026-14392 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoSPriority MEDIUM 64
    • TI-2026-05347 Phar TAR phar_tar_number() Integer Overflow - Archive Entry InjectionPriority MEDIUM 53
    Show all 11 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:87080
Red Hat Hardened ImagesFixed RHSA-2026:70720

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14181
  2. 2026-10-16 Affected versions changed · Red Hat
  3. 2026-10-21 Fix available: RHSA-2026:87080 · Red Hat
  4. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat

References

Advisory 1

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences