CVE-2025-14177

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its getimagesize() and getimagesizefromstring() functions report an image's type and dimensions and, through the optional $imageinfo argument, return the raw APPn metadata segments of a JPEG file.

An Information Exposure vulnerability (CVE-2025-14177) has been identified in the JPEG APP segment reader behind PHP's getimagesize(), which allows an attacker who supplies a crafted or truncated JPEG to make PHP return uninitialized heap memory, which can include data freed earlier in the same request, in the $imageinfo array. PHP tracks this issue as GHSA-3237-qqm7-mfv7.

Per MITRE CWE-908: The product uses or accesses a resource that has not been initialized.

This issue affects PHP 8.1 from 8.1.26 before 8.1.34, PHP 8.2 from 8.2.13 before 8.2.30, PHP 8.3 before 8.3.29, PHP 8.4 before 8.4.16 and PHP 8.5.0, as well as all versions of PHP before 7.1.20 and PHP 7.2 before 7.2.8, including the End-of-Life release lines PHP 5.6 and 7.0 through their final releases (5.6.40 and 7.0.33), which carry an earlier form of the flaw.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <7.1.20, >=7.2.0 <7.2.8, >=8.1.26 <8.1.34, >=8.2.13 <8.2.30, >=8.3.0 <8.3.29, >=8.4.0 <8.4.16, >=8.5.0 <8.5.1
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.20, 7.2.8, 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the standard extension of PHP 8.1 from 8.1.26 before 8.1.34, 8.2 from 8.2.13 before 8.2.30, 8.3 before 8.3.29, 8.4 before 8.4.16 and 8.5.0, and, in an earlier form, in all versions of PHP before 7.1.20 and PHP 7.2 before 7.2.8, including the End-of-Life PHP 5.6 and 7.0 release lines. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N).

The advisory describes the flaw in the PHP 8 code: when an image is read in several chunks, for example through a php://filter stream, php_read_stream_all_chunks() overwrote its buffer without advancing the write position, leaving the tail of the buffer uninitialized. PHP 5.6 has an earlier form of the same problem. Its php_read_APP() allocates a buffer for the length the segment announces, reads once, and treats any non-zero result as success. In PHP 5.6.40 it reads:

buffer = emalloc(length);

if (php_stream_read(stream, buffer, (long) length) <= 0) {
    efree(buffer);
    return 0;
}

snprintf(markername, sizeof(markername), "APP%d", marker - M_APP0);

if (zend_hash_find(Z_ARRVAL_P(info), markername, strlen(markername)+1, (void **) &tmp) == FAILURE) {
    /* XXX we only catch the 1st tag of it's kind! */
    add_assoc_stringl(info, markername, buffer, length, 1);
} 

If the segment is shorter than announced, as in a truncated file, or arrives in several reads, as from a network stream, the read returns fewer bytes than length. The whole buffer, including the part that was never written, is still copied into the APPn entry of $imageinfo. Whatever the heap held there before, which can include data freed by the same request, is returned to the script. The PHP project fixed this form in PHP 7.1.20 as part of bug #71848, but the change was never carried to PHP 5.6.

Exploitation needs an application that calls getimagesize() or getimagesizefromstring() with the $imageinfo argument on an image an attacker supplies, such as an upload or a URL the application fetches, and then returns or stores the APPn data where the attacker can read it. Any SAPI is affected. Applications that do not pass $imageinfo are not affected.

NES for PHP 5 ports the PHP 7.1.20 fix: an APP segment is kept only when it is read in full, otherwise getimagesize() returns false. As upstream, an empty APP segment is now accepted and returned as an empty string.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid passing the $imageinfo argument to getimagesize() for untrusted images, or do not expose the returned APPn data to users.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.20, 7.2.8, 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Nikita Sveshnikov (Positive Technologies) (finder)
• Christoph M. Becker (remediation)
• Nora Dossche (remediation)