CVE-2025-14180 NULL Pointer Dereference in PDO quoting
A null pointer dereference in PHP's PDO PostgreSQL driver can cause server crashes when emulated prepares are enabled and invalid characters are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14180?
CVE-2025-14180 is a high-severity vulnerability in Php Php, published on 27 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Weakness: CWE-476
Which versions are affected by CVE-2025-14180?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 |
php Bitnami | All versions | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 |
php-min Bitnami | All versions | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 |
Products include Php Php.
How do I fix CVE-2025-14180?
Upgrade libphp to a fixed version for your release line: 8.1.34, 8.2.30, 8.3.29 or 8.4.16.
Is CVE-2025-14180 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14180 exists.
Other vulnerabilities in Php Php
Sources
Also known as AZL-73201, AZL-73234, BELL-CVE-2025-14180, BIT-libphp-2025-14180, BIT-php-2025-14180, BIT-php-min-2025-14180 and 8 more.