Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2025-14180

NULL Pointer Dereference in PDO quoting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.1.* to < 8.1.34affected
  • 8.2.* to < 8.2.30affected
  • 8.3.* to < 8.3.29affected
  • 8.4.* to < 8.4.16affected
  • 8.5.* to < 8.5.1affected

References