CVE-2025-14179 is a critical (9.8) SQL injection in the PHP PDO Firebird driver. NUL bytes in quoted strings cut the query short, so later tokens merge into the string. PHP fixed it in 8.2.31, 8.3.31, 8.4.21 and 8.5.6. Upgrade if you use ext-pdo_firebird.
What's affected
The PHP security advisory GHSA-w476-322c-wpvm lists ext-pdo_firebird before 8.2.31, 8.3.31, 8.4.21 and 8.5.6 as affected. Those four versions contain the fix. The advisory published on 7 May 2026 credits Aleksey Solovev and Nikita Sveshnikov of Positive Technologies.
Only applications that use the PDO Firebird driver are affected. The advisory lists no workaround. The affected statements are SELECT, INSERT, UPDATE, DELETE, MERGE, WITH and EXECUTE.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high on all three impact measures.
How to check if you're exposed
Check the PHP version and the driver.
php -v
php -m | grep -i pdo_firebird
php -r "print_r(PDO::getAvailableDrivers());"
If firebird does not appear in the driver list, the vulnerable driver is not loaded in that PHP build. Check each PHP runtime, including CLI, FPM and container images, because they can differ.
On Debian and Ubuntu, the extension may come from a package such as php-interbase, so check your distribution advisories for the patched package version.
What to do now
- List the PHP runtimes you operate and whether the Firebird PDO driver is loaded.
- Upgrade PHP to 8.2.31, 8.3.31, 8.4.21 or 8.5.6, or to your distribution's package that includes the fix.
- Rebuild and redeploy container images based on older PHP versions.
- Use bound parameters instead of building SQL with PDO::quote(), which is the pattern the advisory describes as exposed.
- Restart PHP FPM or the web server and verify the version again.
Why it matters
The weakness is CWE-89, SQL injection, but with an unusual cause. The driver builds the query token by token and copies string tokens with strncat(), which stops at a NUL byte. The closing quote is dropped and the rest of the query is read as part of the string. The application may do everything right with quoting and still be exposed.
The lesson is that quoting is a weaker defense than bound parameters. With bound parameters the value never travels inside the query text, so a flaw in escaping cannot change the query. If your code uses PDO::quote() to build statements, consider moving to prepared statements as part of this upgrade.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use MySQL or PostgreSQL with PDO?
The advisory concerns the PDO Firebird driver only. Check that the Firebird driver is loaded in your PHP runtime.
Is there a workaround?
The advisory lists none. Upgrade to a patched version.
Sources
Last reviewed: 19 October 2026.
