8.2

CVE-2025-14180: php_group php NULL Pointer Dereference

CVSS: 8.2v4.0HighAnalyzed
AliasesUBUNTU-CVE-2025-14180DEBIAN-CVE-2025-14180
Published 27-12-2025Last modified 29-12-2025
Open JSON

Vulnerability summary

CVE-2025-14180 is a high (CVSS 8.2) NULL Pointer Dereference vulnerability in php_group php. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
43/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v4.0 (CVE.org)
EPSS score
0.70%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 18 · Related 6
DSA-6088-1DSA-6154-1MGASA-2025-0330OPENSUSE-SU-2025:15837-1OPENSUSE-SU-2026:20113-1RHSA-2026:1169

Timeline

  1. 27-12-2025
    PublishedVulnerability first disclosed.
  2. 29-12-2025
    Last modifiedVulnerability information updated.

Description

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

CVSS metrics

6 scores · 4 sources · 2 versions

EPSS trend

Probability

0.70%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

-0.01 pp

From 0.71% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.70%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Php Src

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Ubuntu3 products
  • php8.1< 8.1.2-1ubuntu2.23
  • php8.3< 8.3.6-0ubuntu0.24.04.6
  • php8.4< 8.4.11-1ubuntu1.1
Debian2 products
  • php8.2< 8.2.30-1~deb12u1
  • php8.4< 8.4.16-1~deb13u1 | < 8.4.16-1
Php1 product
  • php≥ 8.1.0, < 8.1.34 | ≥ 8.2.0, < 8.2.30 | ≥ 8.3.0, < 8.3.29 | ≥ 8.4.0, < 8.4.16 | ≥ 8.5.0, < 8.5.1
Php_group1 product
  • php≥ 8.1.*, < 8.1.34 | ≥ 8.2.*, < 8.2.30 | ≥ 8.3.*, < 8.3.29 | ≥ 8.4.*, < 8.4.16 | ≥ 8.5.*, < 8.5.1

4 vendors · 7 products

References

7 links