# CVE-2025-14177: In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before…

Source: https://junglewise.ai/threats/cve-2025-14177-in-php-versions-8-1-before-8-1-34-8-2-before-8-2-30-8-3-before-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-27  
License: CC BY 4.0 with a link back

CVE-2025-14177 · Severity: high · CVSS 7.5 · Published 2025-12-27

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

Technologies: [Php](https://junglewise.ai/threats/technologies/php-php). Vendors: [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2025-14177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14177 being exploited in the wild.

**How severe is CVE-2025-14177?** High severity, with a CVSS score of 7.5, published 27 December 2025.

**Which products and versions are affected?** Php. The advisory does not name versions.

**Is there a fix for CVE-2025-14177?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-14177?** Check whether you run Php. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Php

## Related threats

- [PHP stream filter heap information leak with NUL bytes in line-break-chars](https://junglewise.ai/threats/cve-2026-92842-the-convert-base64-encode-convert-quoted-printable-encode-and)
- [PHP OpenSSL stream peer verification certificate validation bypass](https://junglewise.ai/threats/cve-2026-91769-php-s-openssl-stream-peer-verification-checks-the-certificate-s)
- [PHP OpenSSL heap-buffer overflow in wildcard certificate name matching](https://junglewise.ai/threats/cve-2026-91767-php-openssl-matches-wildcard-name-in-ext-openssl-xp-ssl-c)
- [PHP HTTP stream wrapper credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-91766-when-the-http-stream-wrapper-follows-a-redirect-it-forwards-the)
- [PHP SOAP XML parser unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-91765-cleanup-xml-node-in-the-soap-xml-parser-recurses-once-per-xml)