CVE-2025-14177: Information Leak of Memory in getimagesize
Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)
Other sources
In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in phpreadstreamallchunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.34 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.1.34 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.30 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.3.29 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.4.16 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14177?
CVE-2025-14177 is classified as a medium severity vulnerability.
How do I fix CVE-2025-14177?
To fix CVE-2025-14177, upgrade PHP to version 8.1.34 or later.
What type of vulnerability is CVE-2025-14177?
CVE-2025-14177 is an information leak vulnerability occurring in the getimagesize function.
What versions of PHP are affected by CVE-2025-14177?
CVE-2025-14177 affects all versions of PHP prior to 8.1.34.
Is CVE-2025-14177 exploitable remotely?
Yes, CVE-2025-14177 can be exploited remotely by manipulating image processing functions.