PHP CVE-2025-14178

The provided Alpine description ('php83 fixed in 8.3.29-r0') names no specific feature, function, or configuration, so the concrete trigger must be taken from the referenced php-src advisory (GHSA-h96m-rvf9-jgm2), which was not included. From the CVSS vector alone (AV:N/AC:L/PR:N/UI:N) exploitation is network-reachable, unauthenticated, requires no user interaction, and needs no special configuration - but it does require the affected code path to process attacker-controlled input large enough to overflow an integer. Limiting factors: only PHP versions prior to the fixed 8.3.29-r0 (Alpine packaging) are affected, impact is primarily availability/crash (I:L, C:N) rather than code execution or data disclosure, and exploitability in practice depends on whether a deployed application actually exposes the vulnerable function to untrusted input.

Signals conflict, and the input description is a bare Alpine package note ('php83 fixed in 8.3.29-r0') that provides no technical detail, so most of this rests on the CVSS vector and the linked php-src advisory rather than the description itself. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity integer overflow (CWE-190) whose impact is weighted toward availability (A:H) with only low integrity impact (I:L) and explicitly no confidentiality impact (C:N) - i.e. primarily a denial-of-service/crash class issue rather than code execution or data theft. Against that, EPSS is very low (0.02%, 6th percentile), there is no CISA KEV listing, and no public exploit is referenced, so real-world exploitation pressure is currently minimal. The 8.2 'High' score is driven almost entirely by A:H on a network-facing vector; this looks like a genuinely patch-worthy bug given PHP's ubiquity, but not an emergency priority in the absence of exploitation signals. Note a conflict to verify: the input Tags include 'Information Disclosure', yet the CVSS vector sets C:N (no confidentiality impact) and CWE-190 is an integer overflow - treat the information-disclosure characterization as unconfirmed and reconcile against the php-src advisory (GHSA-h96m-rvf9-jgm2).

A remote, unauthenticated attacker sends crafted input to a PHP-backed service that reaches the vulnerable code path, triggering an integer overflow (CWE-190) that corrupts size/length handling and crashes or destabilizes the PHP process, producing a denial of service (A:H). No public exploit code is identified at time of analysis, and the specific triggering input is not described in the provided data (see the php-src advisory for specifics).