# CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1…

Source: https://junglewise.ai/threats/cve-2025-14180-in-php-versions-8-1-before-8-1-34-8-2-before-8-2-30-8-3-before-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-27  
License: CC BY 4.0 with a link back

CVE-2025-14180 · Severity: high · CVSS 7.5 · Published 2025-12-27

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

Technologies: [Php](https://junglewise.ai/threats/technologies/php-php). Vendors: [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2025-14180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14180 being exploited in the wild.

**How severe is CVE-2025-14180?** High severity, with a CVSS score of 7.5, published 27 December 2025.

**Which products and versions are affected?** Php. The advisory does not name versions.

**Is there a fix for CVE-2025-14180?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-14180?** Check whether you run Php. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Php

## Related threats

- [PHP stream filter heap information leak with NUL bytes in line-break-chars](https://junglewise.ai/threats/cve-2026-92842-the-convert-base64-encode-convert-quoted-printable-encode-and)
- [PHP OpenSSL stream peer verification certificate validation bypass](https://junglewise.ai/threats/cve-2026-91769-php-s-openssl-stream-peer-verification-checks-the-certificate-s)
- [PHP OpenSSL heap-buffer overflow in wildcard certificate name matching](https://junglewise.ai/threats/cve-2026-91767-php-openssl-matches-wildcard-name-in-ext-openssl-xp-ssl-c)
- [PHP HTTP stream wrapper credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-91766-when-the-http-stream-wrapper-follows-a-redirect-it-forwards-the)
- [PHP SOAP XML parser unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-91765-cleanup-xml-node-in-the-soap-xml-parser-recurses-once-per-xml)