What’s Vulnerable › Vulnerabilities

CVE-2026-14355: ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-03 · updated 2026-07-08
• Weakness: CWE-122

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Affected products

• Debian Linux: 12.0
• PHP: from 8.2.0 before 8.2.32; from 8.3.0 before 8.3.32; from 8.4.0 before 8.4.23; from 8.5.0 before 8.5.8 — fixed in 8.2.32, 8.3.32, 8.4.23, 8.5.8

How to fix

Upgrade to a fixed version: PHP 8.2.32, 8.3.32, 8.4.23, 8.5.8. Check the vendor advisory for mitigations.

References

• https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr
• https://lists.debian.org/debian-lts-announce/2026/07/msg00010.html

Get alerted when CVE-2026-14355 or the next vulnerability affects your stack