# CVE-2025-14179: PHP PDO Firebird SQL injection via NUL bytes in quoted strings

Source: https://junglewise.ai/threats/cve-2025-14179-php-pdo-firebird-sql-injection-via-nul-bytes-in-quoted-strings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-14179 · Severity: critical · CVSS 9.8 · Published 2026-05-10

A security vulnerability exists in the PHP database driver used for Firebird databases. This flaw allows attackers to bypass security protections when a website processes specially crafted input, potentially leading to unauthorized access or theft of sensitive data stored in the database. Organizations using PHP with Firebird databases should update their PHP installation to the latest patched version immediately.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group).

## Quick answers

**Is CVE-2025-14179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14179 being exploited in the wild.

**How severe is CVE-2025-14179?** Critical severity, with a CVSS score of 9.8, published 10 May 2026.

**Which products and versions are affected?** PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.0 - 8.4.20, 8.5.0 - 8.5.5.

**Is there a fix for CVE-2025-14179?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-14179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-14179?** Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the PHP PDO Firebird driver (pdo_firebird) due to improper handling of NUL bytes (\0) in quoted strings. During token-by-token query construction in firebird_driver.c, the driver uses strncat() to copy string tokens; because strncat() terminates at the first NUL byte, it may fail to append the closing quote of a string literal. This causes subsequent SQL tokens to be incorrectly interpreted as part of the string or vice versa, allowing an attacker to break out of the quoted context. The vulnerability can be exploited if attacker-controlled values containing NUL bytes are processed via PDO::quote() and then embedded into SQL statements. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

## Affected products

- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Enterprise Linux 10

## Timeline

- 2026-05-07: advisory: PHP Group published security advisory GHSA-w476-322c-wpvm
- 2026-05-10: disclosed: CVE-2025-14179 published

## References

- [https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm)
- [https://access.redhat.com/security/cve/CVE-2025-14179](https://access.redhat.com/security/cve/CVE-2025-14179)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2468567](https://bugzilla.redhat.com/show_bug.cgi?id=2468567)
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14179.json](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14179.json)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)