CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing
Published Sep 24, 2026
·Updated
Fixed (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)
Other sources
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
— NVD
Affected Software
2 affected componentsFixes available
PHP PHP<8.4.26
8.4.26
Microsoft azl3 php 8.3.33-1<8.3.35-1
8.3.35-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Sep 24, 2026
CVE Published
via PHP·12:00 AM
Data Sourced
via PHP·12:00 AM
DescriptionAffected Software
Sep 25, 2026
CVE Published
via MITRE·08:26 PM
Data Sourced
via MITRE·08:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Sep 28, 2026
Data Sourced
via Microsoft·06:15 AM
DescriptionSeverityWeaknessAffected Software