Loading story…
PHP has patched two memory-safety vulnerabilities in its ext/standard image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as CVE-2025-14177, affects getimagesize and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as APP1. A second flaw in iptcembed can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single fstat() result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check.
The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for getimagesize, as well as a FIFO-based overflow scenario for iptcembed. PHP addressed the flaws by correcting chunk-buffer pointer handling in php_read_stream_all_chunks and adding boundary checks and safer error handling for iptcembed; fixes were released in PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed the two PHP image-processing vulnerabilities and emphasized exposure for public upload endpoints, CMS thumbnailing systems, webmail services, and image CDNs that inspect user-supplied images. The disclosure noted that both issues had already been patched.
PHP patched both flaws by fixing buffer handling in getimagesize and adding boundary checks and safer error handling in iptcembed. The fixes were released in PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1.
The research included practical proof-of-concept demonstrations for both vulnerabilities, including web-like exploitation scenarios for getimagesize and a FIFO-based setup for iptcembed. These demonstrations showed that attacker-controlled files and streams could realistically trigger the bugs.
The getimagesize issue was assigned CVE-2025-14177 after researchers and the vendor determined that multi-chunk reads of JPEG APP segments could leak uninitialized heap memory through returned metadata. The root cause was incorrect chunk concatenation in php_read_stream_all_chunks.
Positive Technologies researcher Nikita Sveshnikov discovered two flaws in PHP's ext/standard extension affecting getimagesize and iptcembed when processing crafted JPEG-related input. The issues enabled heap memory disclosure in one case and a heap buffer overflow/denial of service in the other.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP disclosed an information disclosure vulnerability in `getimagesize(..., $info)` affecting JPEG APPn metadata parsing in `php-src/ext/standard/image.c`. The flaw occurs during multi-chunk reads: `php_read_stream_all_chunks()` can overwrite the start of the destination buffer without advancing the write pointer, leaving the tail populated with uninitialized or previously freed heap memory. When `getimagesize()` returns metadata such as `$info['APP1']`, the application may receive corrupted data containing leaked process memory. A public proof of concept showed the bug with a crafted JPEG containing a large APP1 segment read through `php://filter`, using repeated filters to force chunked reads and a heap spray marker to demonstrate memory reuse inside the returned APP1 buffer. The issue was reproduced on a PHP `8.6.0-dev` build with AddressSanitizer and debug flags, and the advisory said initial doubts about security impact were revised after maintainers concluded exploitation may also be possible with normal image files if an attacker can predict stream chunk sizes.
Jun 29, 2026
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. `CVE-2026-17543` is an SQL injection flaw in `ext-pgsql` caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through `E'...'` breakout. `CVE-2026-17544` is an out-of-bounds write in `ext-bcmath` where crafted input to `bccomp()` can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact. The vulnerabilities affect PHP versions before `8.2.33`, `8.3.33`, `8.4.24`, and `8.5.9`, with the `bccomp()` flaw applying to `8.4.x` and `8.5.x` before those patched releases. The Canadian Centre for Cyber Security published advisory `AV26-764`, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Jul 31, 2026
Multiple **ImageMagick** vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). **CVE-2026-25794** is a heap-based buffer overflow triggered when writing UHDR images: `WriteUHDRImage` (`coders/uhdr.c`) uses 32-bit `int` arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick **7.1.2-15** includes a patch. Separately, Belgium’s CCB warned that **CVE-2026-23876** is a high-severity heap buffer overflow in the XBM decoder (`ReadXBMImage`) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a **public PoC** and urges immediate patching. A second ImageMagick issue, **CVE-2026-25965**, allows a **policy bypass via path traversal** because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when `policy-secure.xml` is in place. Fixes were reported in **ImageMagick 7.1.2-15** and **6.9.13-40**, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for **Traccar** stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Jun 29, 2026