Executive brief
PHP is a widely used programming language for building websites and web applications. A flaw in its encryption component could allow an attacker to crash a web server or potentially access sensitive information by exploiting a specific, rarely used encryption method. This could lead to service outages or unauthorized data exposure for applications that use this specific encryption feature.
Technical details
A heap-based buffer overflow exists in the PHP OpenSSL extension (ext/openssl) due to a buffer allocation flaw in the AES-WRAP-PAD algorithm implementation. The output buffer for the AES key-wrap-with-padding operation is sized based on the plaintext length without accounting for the 8-byte expansion required by RFC 5649. When OpenSSL's EVP_EncryptUpdate or EVP_EncryptFinal writes the full wrapped output, it exceeds the allocated zend_string buffer, corrupting adjacent Zend MM heap metadata. This can result in an application abort (DoS) or potential information disclosure. The vulnerability is reachable if an application allows user-controlled input to be processed by openssl_encrypt using the affected algorithm. Patches are available in PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8.
Affected products
- PHP Group PHP 8.2.0 to 8.2.31, 8.3.0 to 8.3.31, 8.4.0 to 8.4.22, 8.5.0 to 8.5.7
Timeline
- 2026-07-02: patched: PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 released
- 2026-07-02: advisory: GitHub security advisory published by PHP Group
- 2026-07-03: disclosed: CVE-2026-14355 published to NVD