CVE-2026-14355

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14355
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14355.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14355
Aliases
Downstream
ALPINE (1)
ALSA (7)
AZL (1)
BELL (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (2)
MINI (4)
OESA (5)
openSUSE (2)
RHSA (8)
RLSA (7)
SUSE (4)
UBUNTU (1)
Related
ALSA (7)
openSUSE (2)
SUSE (4)
Published
2026-07-03T20:57:31Z
Modified
2026-11-11T02:55:49Z
Severity
  • 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
Details

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14355.json"
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
70ee6c20ad97e02c2b8098aeea96fefbbc3ac5c2
Fixed
e68d36b614cc80aa76ec6660a84858eaf6957cd2
Introduced
d26068059e83fe40de3430a512471d194119bee0
Fixed
3e35b370570577e6277f8b46a0e73cdf616921fb
Introduced
b437f2b32eb364c9496d24abcc734272e5c9c980
Fixed
52cee85adfeeb6f017f2ac796ab7973353702c20
Introduced
685e99655ae97c667950f7f7d176985958718f56
Fixed
26b97507444c4fbda072f57dda1820f7b7d5e467
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.2.0"
                },
                {
                    "fixed": "8.2.32"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.3.0"
                },
                {
                    "fixed": "8.3.32"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.4.0"
                },
                {
                    "fixed": "8.4.23"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.8"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14355.json"