CVE-2025-14180
MediumSummary
Vulnerability in the PDO PostgreSQL driver for PHP causes an invalid character sequence (e.g., \x99) in a prepared statement parameter to lead to quoting errors when PDO::ATTR_EMULATE_PREPARES is enabled. Affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1.
Risk Assessment
The risk involves potential incorrect SQL query behavior, which could lead to application errors or possible SQL injection if input data is not properly sanitized.
Recommendation
Immediately update PHP to version 8.1.34, 8.2.30, 8.3.29, 8.4.16, or 8.5.1 depending on the branch used. If an update is not possible, temporarily disable the PDO::ATTR_EMULATE_PREPARES option.
Original NVD description (English source)
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting fu