CVE-2026-14355

Analyzed Analyzed - Analysis Complete

Buffer Overflow in PHP OpenSSL Extension

Publication date: 2026-07-03

Last updated on: 2026-07-08

Assigner: PHP Group

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-08

Generated

2026-07-24

AI Q&A

2026-07-04

EPSS Evaluated

2026-07-22

NVD

CVE-2026-14355

Affected Vendors & Products

Vendor	Product	Version / Range
php	php	From 8.2.0 (inc) to 8.2.32 (exc)
php	php	From 8.3.0 (inc) to 8.3.32 (exc)
php	php	From 8.4.0 (inc) to 8.4.23 (exc)
php	php	From 8.5.0 (inc) to 8.5.8 (exc)
debian	debian_linux	12.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in the AES-WRAP-PAD algorithm implementation within the OpenSSL extension of certain PHP versions. Specifically, the output buffer for the AES key-wrap-with-padding operation is allocated based on the plaintext length but does not account for the expansion defined by RFC 5649. As a result, OpenSSL may write beyond the allocated memory buffer, leading to heap metadata corruption and potentially causing the application to abort.

Detection Guidance

This vulnerability may be detected by monitoring for application crashes or aborts related to heap corruption, specifically messages indicating 'zend_mm_heap corrupted' in PHP applications using the OpenSSL extension with the AES-WRAP-PAD algorithm.

To identify if your PHP environment is vulnerable, check the PHP version installed to see if it is before 8.2.32, 8.3.32, 8.4.23, or 8.5.8.

Run `php -v` to determine the PHP version.
Search application logs for error messages containing 'zend_mm_heap corrupted' or unexpected application aborts.

Since the vulnerability is triggered by the use of the AES-WRAP-PAD algorithm in the OpenSSL extension, you can audit your codebase or runtime environment for usage of `openssl_encrypt` with the AES-WRAP-PAD algorithm.

Use commands like `grep -r 'openssl_encrypt' /path/to/your/php/code` to find relevant code.

There are no specific network detection commands provided, as exploitation requires triggering the vulnerable function within PHP applications.

Impact Analysis

The vulnerability can cause memory corruption by writing beyond the allocated buffer, which may lead to application crashes or aborts. This can disrupt normal application functionality and potentially be exploited to affect the integrity and availability of the affected system.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade PHP to a fixed version where the issue is resolved. Specifically, update to PHP versions 8.2.32 or later, 8.3.32 or later, 8.4.23 or later, or 8.5.8 or later.

This vulnerability is related to the AES-WRAP-PAD algorithm implementation in the OpenSSL extension of PHP, so ensuring your PHP installation is updated will prevent the buffer allocation flaw from being exploited.

Hi! I’m here to help you understand CVE-2026-14355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70