CVE-2026-14355 ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
A buffer allocation flaw in PHP's OpenSSL extension allows heap corruption and application abort when using AES-WRAP-PAD encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14355?
CVE-2026-14355 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
Weakness: CWE-122
Which versions are affected by CVE-2026-14355?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.2.0 | 8.2.32, 8.3.32, 8.4.23, 8.5.8 |
php Bitnami | From 8.2.0 | 8.2.32, 8.3.32, 8.4.23, 8.5.8 |
php-min Bitnami | From 8.2.0 | 8.2.32, 8.3.32, 8.4.23, 8.5.8 |
Linux distribution packages (37)
php8.4 AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-bcmath AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-cli AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-common AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-dba AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-dbg AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-devel AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-embedded AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-enchant AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-ffi AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-fpm AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-gd AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-gmp AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-intl AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-ldap AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-mbstring AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-mysqlnd AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-odbc AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-opcache AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-pdo AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-pgsql AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-process AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-snmp AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-soap AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
php8.4-xml AlmaLinux:10 | All versions | 8.4.23-1.el10_2 |
apcu-panel AlmaLinux:8 | All versions | 5.1.18-1.module_el8.6.0+2750+78feabcb |
apcu-panel AlmaLinux:8 | All versions | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
libzip AlmaLinux:8 | All versions | 1.6.1-1.module_el8.10.0+3935+28808425 |
libzip AlmaLinux:8 | All versions | 1.6.1-1.module_el8.6.0+2750+78feabcb |
libzip AlmaLinux:8 | All versions | 1.6.1-1.module_el8.6.0+3239+bedf0508 |
libzip AlmaLinux:8 | All versions | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
libzip-devel AlmaLinux:8 | All versions | 1.6.1-1.module_el8.10.0+3935+28808425 |
libzip-devel AlmaLinux:8 | All versions | 1.6.1-1.module_el8.6.0+3239+bedf0508 |
libzip-devel AlmaLinux:8 | All versions | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
libzip-tools AlmaLinux:8 | All versions | 1.6.1-1.module_el8.10.0+3935+28808425 |
libzip-tools AlmaLinux:8 | All versions | 1.6.1-1.module_el8.6.0+2750+78feabcb |
libzip-tools AlmaLinux:8 | All versions | 1.6.1-1.module_el8.6.0+3239+bedf0508 |
Products include Debian Debian Linux, Php Php.
How do I fix CVE-2026-14355?
Upgrade libphp to a fixed version for your release line: 8.2.32, 8.3.32, 8.4.23 or 8.5.8.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-14355 being exploited?
There is no known exploitation of CVE-2026-14355 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2026:40416, ALSA-2026:47749, ALSA-2026:47750, ALSA-2026:49914, AZL-92001, BELL-CVE-2026-14355 and 29 more.