Loading story…
Positive Technologies researcher Nikita Sveshnikov disclosed JPEG-related memory-safety flaws in PHP image-processing code, including a heap buffer overflow in the iptcembed() path in ext/standard/iptc.c. Crafted JPEG input can drive an out-of-bounds heap write in php_iptc_get1 while PHP parses IPTC markers, causing an AddressSanitizer-enabled PHP 8.6.0-dev build to abort.
The issue was reproduced on Ubuntu 24.04.2 LTS by supplying malformed JPEG data through a named pipe, with the affected call chain including php_iptc_next_marker and zif_iptcembed. Organizations that process attacker-supplied images through PHP functions such as iptcembed() or getimagesize() should track PHP fixes, update affected runtimes promptly, and isolate image-processing workloads until remediation is available.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A php-src pull request/commit titled “Fix GH-20584: Information Leak of Memory” was published, indicating that a source-level fix was submitted for the reported memory disclosure issue.
Researcher Nikita Sveshnikov of Positive Technologies reported a heap buffer overflow in PHP's IPTC handling path, where crafted JPEG input processed by iptcembed() caused an out-of-bounds write in php_iptc_get1. The issue was reproduced on an AddressSanitizer-enabled PHP 8.6.0-dev build and caused the PHP process to abort.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
ptswarm.com
Open sourceptswarm.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcephp.net
Open sourcephp.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026
PHP disclosed an information disclosure vulnerability in `getimagesize(..., $info)` affecting JPEG APPn metadata parsing in `php-src/ext/standard/image.c`. The flaw occurs during multi-chunk reads: `php_read_stream_all_chunks()` can overwrite the start of the destination buffer without advancing the write pointer, leaving the tail populated with uninitialized or previously freed heap memory. When `getimagesize()` returns metadata such as `$info['APP1']`, the application may receive corrupted data containing leaked process memory. A public proof of concept showed the bug with a crafted JPEG containing a large APP1 segment read through `php://filter`, using repeated filters to force chunked reads and a heap spray marker to demonstrate memory reuse inside the returned APP1 buffer. The issue was reproduced on a PHP `8.6.0-dev` build with AddressSanitizer and debug flags, and the advisory said initial doubts about security impact were revised after maintainers concluded exploitation may also be possible with normal image files if an attacker can predict stream chunk sizes.
Jun 29, 2026
Multiple **ImageMagick** vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). **CVE-2026-25794** is a heap-based buffer overflow triggered when writing UHDR images: `WriteUHDRImage` (`coders/uhdr.c`) uses 32-bit `int` arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick **7.1.2-15** includes a patch. Separately, Belgium’s CCB warned that **CVE-2026-23876** is a high-severity heap buffer overflow in the XBM decoder (`ReadXBMImage`) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a **public PoC** and urges immediate patching. A second ImageMagick issue, **CVE-2026-25965**, allows a **policy bypass via path traversal** because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when `policy-secure.xml` is in place. Fixes were reported in **ImageMagick 7.1.2-15** and **6.9.13-40**, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for **Traccar** stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Jun 29, 2026