CVE-2025-14180

HIGH

PHP <8.1.34, <8.2.30, <8.3.29, <8.4.16, <8.5.1 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-14180. PoCs published by gl1tch0x1.

AI-analyzed exploit summary This repository contains a modular exploit framework for multiple PHP CVEs, including CVE-2025-14180. It includes detection and exploitation logic for vulnerabilities in PHP 8.1.x, with support for remote and local exploitation.

Description

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

Exploits (1)

github WORKING POC
by gl1tch0x1 · shellpoc
https://github.com/gl1tch0x1/PHP_8.1.x_Exploit

This repository contains a modular exploit framework for multiple PHP CVEs, including CVE-2025-14180. It includes detection and exploitation logic for vulnerabilities in PHP 8.1.x, with support for remote and local exploitation.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHP 8.1.x
No auth needed
Prerequisites: target URL or list of URLs · PHP CLI for local exploitation · reverse shell IP and port for remote exploitation
devstral-2 · analyzed Apr 29, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0057
EPSS Percentile 42.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (1)
php/php 8.1.0 - 8.1.34
Published Dec 27, 2025
Tracked Since Feb 18, 2026