Is CVE-2025-14179 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14179 being exploited in the wild.

How severe is CVE-2025-14179?

Critical severity, with a CVSS score of 9.8, published 10 May 2026.

Which products and versions are affected?

PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.0 - 8.4.20, 8.5.0 - 8.5.5.

Is there a fix for CVE-2025-14179?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-14179 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-14179?

Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14179: PHP PDO Firebird SQL injection via NUL bytes in quoted strings

CVE-2025-14179 · Severity: critical · CVSS 9.8 · Published 2026-05-10

A security vulnerability exists in the PHP database driver used for Firebird databases. This flaw allows attackers to bypass security protections when a website processes specially crafted input, potentially leading to unauthorized access or theft of sensitive data stored in the database. Organizations using PHP with Firebird databases should update their PHP installation to the latest patched version immediately.

Technologies: PHP Group PHP. Vendors: PHP Group.

Quick answers

Is CVE-2025-14179 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14179 being exploited in the wild.
How severe is CVE-2025-14179?: Critical severity, with a CVSS score of 9.8, published 10 May 2026.
Which products and versions are affected?: PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.0 - 8.4.20, 8.5.0 - 8.5.5.
Is there a fix for CVE-2025-14179?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-14179 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-14179?: Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the PHP PDO Firebird driver (pdo_firebird) due to improper handling of NUL bytes (\0) in quoted strings. During token-by-token query construction in firebird_driver.c, the driver uses strncat() to copy string tokens; because strncat() terminates at the first NUL byte, it may fail to append the closing quote of a string literal. This causes subsequent SQL tokens to be incorrectly interpreted as part of the string or vice versa, allowing an attacker to break out of the quoted context. The vulnerability can be exploited if attacker-controlled values containing NUL bytes are processed via PDO::quote() and then embedded into SQL statements. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

Affected products

PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
Red Hat Enterprise Linux 10

Timeline

2026-05-07: advisory: PHP Group published security advisory GHSA-w476-322c-wpvm
2026-05-10: disclosed: CVE-2025-14179 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.