CVE-2026-14355 | In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.… | CVSS 5.6 MEDIUM

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Metadata

CVE ID: CVE-2026-14355
State: PUBLISHED
Assigner: php
Reserved: 2026-07-01 17:52 UTC
Published: 2026-07-03 20:57 UTC
Last updated: 2026-07-03 20:59 UTC
Primary CWE: CWE-122
CWE-122 Heap-based buffer overflow
Vendor / Product: php / php
Sources: cve.org · NVD

Severity & Metrics

5.6 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products (1)

Vendor	Product	Platform	Versions
php	php	—	8.2.0 < 8.2.32, 8.3.0 < 8.3.32, 8.4.0 < 8.4.23, 8.5.0 < 8.5.8

Weakness (CWE)

CWE	Source	Description
CWE-122	cna	CWE-122 Heap-based buffer overflow

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.6	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References (1)

GitHub Security Advisory GHSA-7jrw-539f-x6vr https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr