Skip to content
CVE PROGRAM SOURCE RECORD5.6 Medium

CVE-2026-14355

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

php php

Default version status: affected

  • 8.2.0 to < 8.2.32affected
  • 8.3.0 to < 8.3.32affected
  • 8.4.0 to < 8.4.23affected
  • 8.5.0 to < 8.5.8affected

References