Log in Start free

Vulnerability · Published May 10, 2026 · Assigned by php

CVE-2025-14179SQL injection in pdo_firebird via NUL bytes in quoted strings

High 8.1

In plain English

A high-severity SQL injection in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 61.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php8.28.2.31-1~deb12u1DEBIAN-CVE-2025-14179
Debian:13php8.48.4.21-1~deb13u1DEBIAN-CVE-2025-14179
Debian:14php8.48.4.21-1DEBIAN-CVE-2025-14179
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.24UBUNTU-CVE-2025-14179
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.9UBUNTU-CVE-2025-14179
Ubuntu:25.10php8.48.4.11-1ubuntu1.2UBUNTU-CVE-2025-14179
Ubuntu:26.04:LTSphp8.58.5.4-0ubuntu1.1UBUNTU-CVE-2025-14179

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.2.* – before 8.2.318.3.* – before 8.3.318.4.* – before 8.4.218.5.* – before 8.5.6

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References