CVE-2025-14177 — PHP getimagesize() Heap Memory Leak

For authorized penetration testing and security research only.

Vulnerability

Affected versions

• PHP < 8.1.34
• PHP < 8.2.30
• PHP < 8.3.29
• PHP < 8.4.16
• PHP < 8.5.1

Fixed in

• PHP 8.1.34 / 8.2.30 / 8.3.29 / 8.4.16 / 8.5.1

Bug mechanics

getimagesize("php://filter/.../resource=malicious.jpg", $info)
    └─ php_read_stream_all_chunks()
        ├─ Chunk 1 (8KB) → memcpy(buffer+0, chunk1, 8192)
        ├─ Chunk 2 (8KB) → memcpy(buffer+0, chunk2, 8192)  ← overwrites!
        └─ $info['APP1'] = chunk2 + uninitialized heap garbage

Malicious JPEG carries an oversized APP1 marker (16KB) to force the multi-chunk read path. The returned APP1 field leaks heap memory that may contain credentials, tokens, session data, or ASLR pointers.

Attack flow

[1] RECON      Find PHP app exposing getimagesize() output (APP1 field)
[2] PREP       Craft malicious.jpg (APP1 = 16KB)
[3] EXPLOIT    Upload → trigger getimagesize($file, $info)
[4] EXTRACT    Parse $info['APP1'] for leaked heap data
[5] IMPACT     Credential theft / token extraction / ASLR bypass

Usage

python3 CVE-2025-14177.py [mode]

Output (./exploit_output/)

exploit_output/
├── malicious.jpg          # crafted JPEG payload (APP1 = 16KB)
├── exploit_standalone.php # deployable PHP exploit
├── exploit_report.json    # full analysis report
└── test_cases.json        # 3 test scenarios

Test scenarios

Detection

• Large APP1 markers in JPEG uploads (> 8192 bytes)
• Unusual memory patterns in $info array
• Repeated getimagesize() calls with php://filter wrappers
• Hex-encoded data exfiltration in responses

Remediation

Upgrade PHP to patched version. No workaround — patch required.

php -v  # verify version

If upgrade blocked: strip APP1 from $info before returning to client, or disable php://filter in allow_url_fopen.

Disclaimer

This tool is for authorized security testing only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal.