CVE-2025-14180: NULL Pointer Dereference in PDO quoting
Fixed (PDO quoting result null deref). (CVE-2025-14180)
Other sources
In PHP versions 8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTREMULATEPREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdoparseparams() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.34 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.34 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.30 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.29 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.16 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14180?
The severity of CVE-2025-14180 is classified as moderate.
How do I fix CVE-2025-14180?
To fix CVE-2025-14180, you should upgrade to PHP version 8.1.34 or later.
What type of vulnerability is CVE-2025-14180?
CVE-2025-14180 is a vulnerability related to PDO quoting resulting in a null dereference.
Which versions of PHP are affected by CVE-2025-14180?
CVE-2025-14180 affects all PHP versions prior to 8.1.34.
Is there a patch available for CVE-2025-14180?
Yes, a patch for CVE-2025-14180 is included in PHP version 8.1.34.