CVE-2026-14355: ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
ext/openssl: Memory corruption in opensslencrypt with AES-WRAP-PAD
Other sources
Fixed bug (Memory corruption (zendmmheap corrupted) in opensslencrypt with AES-WRAP-PAD). (CVE-2026-14355)
— PHP
In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.23 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.32-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.23-1~deb13u1Fixed in 8.4.23-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.32-1 - Upgrade
Upgrade
php/ext/opensslto a version that resolves this vulnerability.Fixed in 8.2.32 - Upgrade
Upgrade
php/ext/opensslto a version that resolves this vulnerability.Fixed in 8.3.32 - Upgrade
Upgrade
php/ext/opensslto a version that resolves this vulnerability.Fixed in 8.4.23 - Upgrade
Upgrade
php/ext/opensslto a version that resolves this vulnerability.Fixed in 8.5.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14355?
The severity of CVE-2026-14355 is medium with a score of 5.6.
How do I fix CVE-2026-14355?
To fix CVE-2026-14355, upgrade your PHP version to 8.2.32, 8.3.32, 8.4.23, or 8.5.8 or later.
What systems are affected by CVE-2026-14355?
CVE-2026-14355 affects PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, and 8.5.* before 8.5.8.
What type of vulnerability is CVE-2026-14355?
CVE-2026-14355 is a memory corruption vulnerability in the openssl_encrypt function related to the AES-WRAP-PAD implementation.
What impact does CVE-2026-14355 have?
CVE-2026-14355 could lead to potential memory corruption, which may affect system stability and data integrity.