CVE-2025-14181

Integer overflow to buffer overflow in SOAP HTTP parsing

Publication Date 2026-09-25
Severity Moderate
Type Remote Code Execution
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.33
  • 8.3.0-8.3.34
  • 8.4.0-8.4.25
  • 8.5.0-8.5.10
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.8

CVE Details

The SOAP HTTP client uses a signed integer overflow guard to limit response buffer growth. When the compiler optimizes away this check, a malicious SOAP server can cause the client to allocate a buffer that is far smaller than what it subsequently writes into, producing a heap buffer overflow that may allow arbitrary code execution in the PHP process.

Recommendations

Ensure you trust SOAP servers to which you connect. If you cannot guarantee they are not maintained by malicious actors, consider using a userland SOAP client such as phpro/soap-client, which operates without the PHP SOAP extension. Otherwise, update to a patched version of PHP.