# CVE-2026-14355: PHP OpenSSL extension heap overflow in AES-WRAP-PAD

Source: https://junglewise.ai/threats/cve-2026-14355-php-openssl-extension-heap-overflow-in-aes-wrap-pad  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-14355 · Severity: medium · CVSS 5.6 · Published 2026-07-03

PHP is a widely used programming language for building websites and web applications. A flaw in its encryption component could allow an attacker to crash a web server or potentially access sensitive information by exploiting a specific, rarely used encryption method. This could lead to service outages or unauthorized data exposure for applications that use this specific encryption feature.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group).

## Quick answers

**Is CVE-2026-14355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14355 being exploited in the wild.

**How severe is CVE-2026-14355?** Medium severity, with a CVSS score of 5.6, published 3 July 2026.

**Which products and versions are affected?** PHP Group PHP 8.2.0 to 8.2.31, 8.3.0 to 8.3.31, 8.4.0 to 8.4.22, 8.5.0 to 8.5.7.

**Is there a fix for CVE-2026-14355?** A patch was published on 2026-07-02: PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14355 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14355?** Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the PHP OpenSSL extension (ext/openssl) due to a buffer allocation flaw in the AES-WRAP-PAD algorithm implementation. The output buffer for the AES key-wrap-with-padding operation is sized based on the plaintext length without accounting for the 8-byte expansion required by RFC 5649. When OpenSSL's EVP_EncryptUpdate or EVP_EncryptFinal writes the full wrapped output, it exceeds the allocated zend_string buffer, corrupting adjacent Zend MM heap metadata. This can result in an application abort (DoS) or potential information disclosure. The vulnerability is reachable if an application allows user-controlled input to be processed by openssl_encrypt using the affected algorithm. Patches are available in PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8.

## Affected products

- PHP Group PHP 8.2.0 to 8.2.31, 8.3.0 to 8.3.31, 8.4.0 to 8.4.22, 8.5.0 to 8.5.7

## Timeline

- 2026-07-02: patched: PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 released
- 2026-07-02: advisory: GitHub security advisory published by PHP Group
- 2026-07-03: disclosed: CVE-2026-14355 published to NVD

## References

- [https://www.php.net/](https://www.php.net/)
- [https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr](https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)