Weaponized JPEG Images A pair of memory-safety vulnerabilities lurking within PHP's image-handling functions, CVE-2025-14177 and an unpatched heap overflow in iptcembed, could allow attackers to leak sensitive server memory or crash PHP applications using a crafted JPEG file. This blind spot proved dangerous: Positive Technologies researcher Nikita Sveshnikov uncovered two memory management bugs while auditing the extension's C code, both triggered through standard JPEG image processing functions. An attacker who knows the default chunk size (8,192 bytes) can craft a JPEG to deliberately trigger multi-chunk reads and harvest fragments of process memory, potentially exposing tokens, credentials, or other sensitive data stored elsewhere on the heap.
The vulnerable write occurs byte-by-byte in php_iptc_get1(), where each character is appended to the buffer pointer without bounds validation, as confirmed by AddressSanitizer stack traces showing a write past a 1,087-byte-allocated region. Affected Versions & Recommended Actions Function Bug Type | CVE | CVSS | Fixed In --- | --- | --- | --- getimagesize() | CVE-2025-14177 | 6.3 | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 iptcembed() | Heap buffer overflow | N/A | PHP commit Nov 26, 2025 Users running PHP applications that process user-supplied images, particularly those calling `getimagesize()` with the `$image_info` parameter or using `iptcembed()` on untrusted files, should immediately upgrade to the patched versions listed above.
