CVE-2022-31625: 
PHP vulnerability analysis and mitigation

CVE-2022-31625 affects PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7. The vulnerability exists in the Postgres database extension where supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers (CVE-MITRE, NVD).

The vulnerability occurs in the pg_query_params() function when using the Postgres database extension. When invalid parameters are supplied to the parametrized query, PHP attempts to free memory using uninitialized data as pointers. The issue stems from an uninitialized array in the function implementation. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with attack vector Network, attack complexity Low, and no privileges or user interaction required (NetApp Advisory).

Successful exploitation of this vulnerability could lead to Remote Code Execution (RCE) or Denial of Service (DoS) conditions (CVE-MITRE, Debian Advisory).

The vulnerability has been fixed in PHP versions 7.4.30, 8.0.20, and 8.1.7. Users are advised to upgrade to these or later versions. The fix involves properly initializing the array in pg_query_params() function (PHP Bug, Debian Advisory).