CVE-2026-14355: PHP OpenSSL AES-WRAP-PAD Buffer Overflow DoS

Technical summary

CVE-2026-14355 is a heap buffer overflow in the OpenSSL extension's AES-WRAP-PAD implementation across PHP 8.2, 8.3, 8.4, and 8.5 release lines. The root cause is undersized output buffer allocation during RFC 5649 AES key-wrap-with-padding operations. RFC 5649 specifies that padding expansion adds overhead to the plaintext; the vulnerable code sizes the output buffer only to the plaintext length, omitting this expansion. When OpenSSL performs the wrap-with-padding operation, it writes beyond the allocated bounds, corrupting heap metadata. This typically manifests as application termination rather than controlled exploitation, though memory disclosure prior to crash remains theoretically possible.

Business impact

Applications using PHP to decrypt wrapped keys—common in cryptographic key management systems, payment processors, and security appliances—become unstable. Repeated key unwrap operations from untrusted network sources can be weaponized to repeatedly crash service processes, creating a denial-of-service condition. Recovery requires manual intervention and patching. Organizations managing hardware security module (HSM) integrations, certificate-based authentication, or envelope encryption schemes are especially at risk.

Affected systems

PHP 8.2.x before 8.2.32, PHP 8.3.x before 8.3.32, PHP 8.4.x before 8.4.23, and PHP 8.5.x before 8.5.8 are affected. Debian Linux distributions shipping vulnerable PHP versions are also in scope. This affects CLI applications, web servers (Apache, Nginx with PHP-FPM), and embedded PHP runtimes. Systems on earlier PHP 8.1 or 7.x branches are unaffected.

Exploitability

Exploitation requires the ability to supply a specially crafted wrapped key to an affected PHP application that calls the OpenSSL extension's aes_wrap or openssl_encrypt with AES-WRAP-PAD mode. The attack surface depends on how the application exposes key unwrapping—direct network exposure (rare) is easier than exploitation via authenticated endpoints or file uploads. The CVSS vector reflects medium severity: network-accessible but requiring high complexity (AC:H) due to specific algorithm usage patterns. The vulnerability is not known to be in active exploitation (not added to the KEV catalog), reducing immediate threat urgency.

Remediation

Patch to PHP 8.2.32, 8.3.32, 8.4.23, or 8.5.8 (or later). Debian users should await security advisories; most distributions will backport fixes. No workaround exists short of avoiding AES-WRAP-PAD operations or moving away from PHP for key unwrapping. Organizations unable to patch immediately should audit which applications use this specific encryption mode and isolate them or restrict untrusted input.

Patch guidance

Verify the patch version against official PHP release notes and vendor advisories before deployment. Test thoroughly in staging, as memory-related fixes occasionally affect edge cases in cryptographic operations. Rolling restart of PHP-FPM pools or application servers is typically safe post-patch. For Debian systems, enable automatic security updates or monitor Debian Security Advisories (DSA) for backported packages.

Detection guidance

Monitor system logs and application error logs for unexpected PHP process crashes, particularly in code paths that handle key unwrapping or use openssl_encrypt/openssl_decrypt with AES-WRAP-PAD. Heap corruption often produces segmentation fault logs or core dumps. Intrusion detection systems should flag unusual wrapped-key formats or repeated failed decryption attempts from external sources. Inventory running PHP versions and check against the vulnerable ranges.

Why prioritize this

Although not in active exploitation, this vulnerability affects core cryptographic operations in widely deployed PHP installations. Medium CVSS score reflects the denial-of-service impact without code execution. Prioritize based on whether your organization runs affected PHP versions and whether those versions handle untrusted wrapped keys. Organizations with key management or payment systems should patch sooner; general web applications with standard encryption workflows can take a standard update cycle.

Risk score, explained

CVSS 3.1 score of 5.6 (MEDIUM) reflects network accessibility, low complexity barriers (specific algorithm usage), and limited impact scope (application availability rather than confidentiality breach). The score does not account for the practical rarity of AES-WRAP-PAD usage; many PHP applications may never trigger this code path. Organizational risk depends heavily on use case: systems that never unwrap keys have zero risk regardless of patched status.

Frequently asked questions