Assessment
Why it matters
EPSS is 0.4%; technical severity is CVSS 7.4.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Who should care
- Teams operating PHP
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether PHP is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Red Hat Security advisory CVE-2025-14179
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Technical details
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber
- CWE
- CWE-89
- Affected versions
- PHP PHP (Start Including 8.2.0, End Excluding 8.2.31 | Start Including 8.3.0, End Excluding 8.3.31 | Start Including 8.4.0, End Excluding 8.4.21 | Start Including 8.5.0, End Excluding 8.5.6)
- Fixed versions
- PHP PHP (Fixed from 8.2.31, 8.3.31, 8.4.21, 8.5.6)
- Published
- 10 May 2026
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
Signal timeline
- CVE published
- Latest EPSS score: 0.4%
- Signal calculated at 12