Is CVE-2026-14355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14355 being exploited in the wild.

How severe is CVE-2026-14355?

Medium severity, with a CVSS score of 5.6, published 3 July 2026.

Which products and versions are affected?

PHP Group PHP 8.2.0 to 8.2.31, 8.3.0 to 8.3.31, 8.4.0 to 8.4.22, 8.5.0 to 8.5.7.

Is there a fix for CVE-2026-14355?

A patch was published on 2026-07-02: PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14355 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14355?

Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14355: PHP OpenSSL extension heap overflow in AES-WRAP-PAD

CVE-2026-14355 · Severity: medium · CVSS 5.6 · Published 2026-07-03

PHP is a widely used programming language for building websites and web applications. A flaw in its encryption component could allow an attacker to crash a web server or potentially access sensitive information by exploiting a specific, rarely used encryption method. This could lead to service outages or unauthorized data exposure for applications that use this specific encryption feature.

Technologies: PHP Group PHP. Vendors: PHP Group.

Quick answers

Is CVE-2026-14355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14355 being exploited in the wild.
How severe is CVE-2026-14355?: Medium severity, with a CVSS score of 5.6, published 3 July 2026.
Which products and versions are affected?: PHP Group PHP 8.2.0 to 8.2.31, 8.3.0 to 8.3.31, 8.4.0 to 8.4.22, 8.5.0 to 8.5.7.
Is there a fix for CVE-2026-14355?: A patch was published on 2026-07-02: PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14355 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14355?: Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the PHP OpenSSL extension (ext/openssl) due to a buffer allocation flaw in the AES-WRAP-PAD algorithm implementation. The output buffer for the AES key-wrap-with-padding operation is sized based on the plaintext length without accounting for the 8-byte expansion required by RFC 5649. When OpenSSL's EVP_EncryptUpdate or EVP_EncryptFinal writes the full wrapped output, it exceeds the allocated zend_string buffer, corrupting adjacent Zend MM heap metadata. This can result in an application abort (DoS) or potential information disclosure. The vulnerability is reachable if an application allows user-controlled input to be processed by openssl_encrypt using the affected algorithm. Patches are available in PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8.

Affected products

PHP Group PHP 8.2.0 to 8.2.31, 8.3.0 to 8.3.31, 8.4.0 to 8.4.22, 8.5.0 to 8.5.7

Timeline

2026-07-02: patched: PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 released
2026-07-02: advisory: GitHub security advisory published by PHP Group
2026-07-03: disclosed: CVE-2026-14355 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.