All vulnerabilities
CVE-2025-14181GHSA-cj93-vc83-wgqv

PHP: Integer overflow to buffer overflow in soap HTTP parsing

PHP Group PHPRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 25 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.2.34Also 8.3.35, 8.4.26 and 1 moreCVE List
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

Text from CVE List

Affected versions 8

  • PHPaffected: 8.2.* before 8.2.34CVE List
  • PHPaffected: 8.3.* before 8.3.35CVE List
  • PHPaffected: 8.4.* before 8.4.26CVE List
  • PHPaffected: 8.5.* before 8.5.11CVE List
  • ext-soap, php<8.2.34GitHub
  • ext-soap, php<8.3.35GitHub
  • ext-soap, php<8.4.26GitHub
  • ext-soap, php<8.5.11GitHub

References 1