CVE-2025-14180: 
PHP vulnerability analysis and mitigation

CVE-2025-14180 is a NULL Pointer Dereference vulnerability in PHP's PDO PostgreSQL driver that can cause a segmentation fault and denial of service. When PDO::ATTR_EMULATE_PREPARES is enabled, an invalid character sequence (e.g., \x99) in a prepared statement parameter causes the PostgreSQL quoting function PQescapeStringConn to return NULL, which is then dereferenced in pdo_parse_params(). Affected versions include PHP 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, and 8.5.* before 8.5.1. The vulnerability was discovered by Aleksey Solovev of Positive Technologies and published on December 27, 2025. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (PHP Advisory, Red Hat).

The root cause is a NULL Pointer Dereference (CWE-476) in the pdo_parse_params() function within php-src/ext/pdo/pdo_sql_parser.re. When PDO::ATTR_EMULATE_PREPARES is enabled, PHP manually quotes parameters using the driver's quoting function; for the PostgreSQL driver, this calls pgsql_handle_quoter, which in turn calls the libpq function PQescapeStringConn. When an invalid byte sequence such as \x99 is passed, PQescapeStringConn returns NULL instead of a valid string. The result is assigned to plc->quoted, and the subsequent ZSTR_LEN(plc->quoted) macro dereferences this NULL pointer, triggering a segmentation fault. Exploitation requires no authentication or privileges — only that the target application uses the PDO PostgreSQL driver with emulated prepares enabled and accepts user-controlled input as query parameters (PHP Advisory).

Successful exploitation causes a segmentation fault that crashes the PHP process, resulting in a denial of service (DoS) for the affected application. In PHP ZTS (Zend Thread Safety) mode, a crash can terminate all currently active requests within the same process, amplifying the availability impact. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications relying on PHP with a PostgreSQL backend using emulated prepared statements are at risk of complete service disruption if user-supplied input is not sanitized before being passed to PDO queries (PHP Advisory, Red Hat).

A proof-of-concept (PoC) is publicly available in the official PHP security advisory on GitHub, demonstrating the segmentation fault with a minimal PHP script (PHP Advisory). An additional PoC repository targeting PHP 8.1.x has been published on GitHub and indexed by Sploitus. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044%, reflecting low current exploitation probability. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify web applications using PHP (versions 8.1.x < 8.1.34, 8.2.x < 8.2.30, 8.3.x < 8.3.29, 8.4.x < 8.4.16, or 8.5.x < 8.5.1) with a PostgreSQL backend. Look for endpoints that accept user input passed to database queries.
2. Confirm PDO emulated prepares: Determine whether the application uses PDO::ATTR_EMULATE_PREPARES => true — this is sometimes the default or explicitly set for compatibility reasons.
3. Craft malicious input: Prepare a request payload containing an invalid byte sequence such as \x99 (a byte not valid in the server's character encoding, e.g., UTF-8) as a parameter value intended for a PDO prepared statement.
4. Submit the request: Send the crafted input to the vulnerable endpoint (e.g., via an HTTP POST or GET request with the malicious parameter). The PHP application passes this value to $stmt->execute(['param' => "value\x99"]).
5. Trigger the crash: The PDO PostgreSQL driver calls PQescapeStringConn with the invalid sequence, which returns NULL. The pdo_parse_params() function dereferences this NULL pointer via ZSTR_LEN(plc->quoted), causing a segmentation fault and crashing the PHP process — resulting in a 500 error or service unavailability (PHP Advisory).

• Logs: PHP error logs or web server logs showing repeated segmentation fault messages (e.g., Segmentation fault in php-fpm or Apache/Nginx error logs) correlated with requests to database-querying endpoints.
• Logs: Application logs showing PDOException or unexpected process termination immediately after receiving requests with non-UTF-8 or invalid byte sequences in parameters.
• Network: HTTP requests to PHP endpoints containing raw non-printable or invalid byte sequences (e.g., \x99, \x80–\xBF outside valid UTF-8 ranges) in query parameters or POST body fields.
• Process: Unexpected termination or restart of php-fpm worker processes; core dump files generated in the PHP working directory following crashes.
• File System: Presence of core dump files (e.g., core.*) in the web application or PHP working directory following repeated crashes.

Upgrade PHP to a patched version: 8.1.34, 8.2.30, 8.3.29, 8.4.16, or 8.5.1, depending on the branch in use (PHP Advisory). As a temporary workaround prior to patching, disable PDO::ATTR_EMULATE_PREPARES if it is not required — using native prepared statements avoids the vulnerable code path entirely. Additionally, implement server-side input validation to reject or sanitize invalid byte sequences before they reach PDO query parameters. Linux distribution patches are available from Red Hat (RHSA-2026:1169, RHSA-2026:1185, RHSA-2026:1187, RHSA-2026:1190, RHSA-2026:1628), Debian (DSA-6088-1), Ubuntu (USN-7953-1), Fedora, Slackware, Mageia, and Amazon Linux (Red Hat).

The vulnerability was discovered and reported by Aleksey Solovev of Positive Technologies, who is credited in the official PHP security advisory (PHP Advisory). The advisory was published with a "Moderate" severity rating by the PHP project, though NVD and Red Hat assigned it a higher CVSS v3.1 score of 7.5 (High). Multiple Linux distributions — including Red Hat, Debian, Ubuntu, Fedora, Slackware, and Mageia — issued security advisories and patches shortly after disclosure, indicating broad ecosystem attention. Community coverage appeared on security blogs and Linux news aggregators, with Tenable publishing multiple Nessus detection plugins for the vulnerability.