Loading story…
PHP disclosed an information disclosure vulnerability in getimagesize(..., $info) affecting JPEG APPn metadata parsing in php-src/ext/standard/image.c. The flaw occurs during multi-chunk reads: php_read_stream_all_chunks() can overwrite the start of the destination buffer without advancing the write pointer, leaving the tail populated with uninitialized or previously freed heap memory. When getimagesize() returns metadata such as $info['APP1'], the application may receive corrupted data containing leaked process memory.
A public proof of concept showed the bug with a crafted JPEG containing a large APP1 segment read through php://filter, using repeated filters to force chunked reads and a heap spray marker to demonstrate memory reuse inside the returned APP1 buffer. The issue was reproduced on a PHP 8.6.0-dev build with AddressSanitizer and debug flags, and the advisory said initial doubts about security impact were revised after maintainers concluded exploitation may also be possible with normal image files if an attacker can predict stream chunk sizes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub published a security advisory for php/php-src describing the zero-day information leak and noting that exploitation might be possible on normal images if an attacker can predict stream chunk sizes. The advisory also documented the root cause in php_read_stream_all_chunks() behavior during chunked reads.
A researcher reported an information disclosure flaw in PHP's getimagesize(..., $info) JPEG APPn metadata parsing in ext/standard/image.c. The issue involved multi-chunk reads corrupting the returned APPn buffer and potentially exposing uninitialized heap memory.
A public php/php-src issue disclosed a proof of concept showing getimagesize() returning corrupted APP1 JPEG metadata and reusing heap contents, including a sprayed marker string found in the returned buffer. The report showed reproduction on a PHP 8.6.0-dev build with AddressSanitizer and debug flags using php://filter to force chunked reads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026
Researchers detailed how `CVE-2024-2961`, a long-standing buffer overflow in glibc's `iconv` implementation for `ISO-2022-CN-EXT`, can be exploited to achieve remote code execution in PHP applications. The technique, dubbed **CNEXT**, builds on earlier work around PHP filter chains and error-based file-read oracles, showing how `php://filter` can be abused not just to read files but to manipulate PHP heap allocations and corrupt internal memory structures. By chaining filters such as `convert.iconv`, `zlib.inflate`, and `dechunk`, the exploit can steer allocator behavior and overwrite `zend_mm_heap` hooks so that PHP ultimately invokes `system()`. The write-up says the method is reliable across PHP `7.0.0` through `8.3.7` and can be delivered in a single GET request, significantly raising the impact of otherwise limited file-read primitives. A demonstrated attack used the WordPress BuddyForms flaw `CVE-2023-26326` to gain file-read access and then escalate to code execution, while the researchers warned that the same path could affect other PHP file-read sinks, including XXE and SQL injection scenarios involving `LOAD DATA LOCAL INFILE`. The findings also revive attention on PHP filter-chain abuse first explored in prior research, showing that seemingly minor disclosure bugs can become full server compromise when combined with glibc and PHP internals.
Jun 29, 2026
A high-severity heap buffer overflow in **ImageMagick**’s XBM image decoder (`coders/xbm.c`, `ReadXBMImage`) can be triggered by processing a specially crafted **XBM** file, including through common image upload/processing workflows. The flaw stems from **integer truncation** where `image->rows` (a 64-bit `size_t`) is cast to a 32-bit `unsigned int` for allocation, but subsequent write operations iterate using the original (non-truncated) `image->rows` value, creating a mismatch that can lead to memory corruption or crashes when attacker-supplied dimensions are large. Reporting indicates the overflow is particularly dangerous because attackers can influence both the **overflow size** (via image dimensions such as rows/columns) and the **data written** (via hex values embedded in the XBM content), enabling attacker-controlled bytes to be written past the heap buffer. The issue affects ImageMagick versions **prior to 7.1.2-13 and 6.9.13-38** and is fixed in **7.1.2-13** and **6.9.13-38**; the CVE record lists a high-impact CVSS vector `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` and maps the weakness to **CWE-190** and **CWE-122**, with upstream references including the vendor advisory and patch commit.
Jun 29, 2026