Critical PHP Memory Safety Vulnerabilities Exposed by Malicious JPEG Files

Severity: High (Score: 64.5)

Sources: Cybersecuritynews, Gbhackers

Published: 2026-05-18 · Updated: 2026-05-19

Keywords: memory, crafted, trigger, jpeg, vulnerabilities, jpegs, bugs

Severity indicators: vulnerabilities, bug

Summary

Two critical memory-safety vulnerabilities in PHP's image-processing functions were discovered by Positive Technologies researcher Nikita Sveshnikov. These flaws affect the widely-used getimagesize and iptcembed functions in PHP's ext/standard extension. Attackers can exploit these vulnerabilities to leak sensitive heap memory or execute denial-of-service attacks using specially crafted JPEG files. The vulnerabilities highlight a significant risk in PHP's handling of untrusted input, particularly image files, which are commonly used in web applications. PHP is a widely used web programming language, making the potential impact substantial. As of now, no specific CVEs have been assigned, but the vulnerabilities are under investigation. Security professionals are advised to monitor for updates and apply necessary mitigations. Key Points: • Two critical memory-safety vulnerabilities in PHP's image-processing functions were discovered. • Attackers can exploit these flaws using specially crafted JPEG files to leak memory or cause denial-of-service. • PHP's ext/standard extension is specifically affected, raising concerns about its handling of untrusted input.

Detailed Analysis

**Impact** The vulnerabilities affect PHP installations worldwide, particularly those using the ext/standard extension’s getimagesize and iptcembed functions to process JPEG metadata. Given PHP’s widespread use in web applications across multiple sectors, including e-commerce and content management, attackers could leak sensitive heap memory or cause denial-of-service conditions. No specific geographic or sectoral impact data is provided in the articles. **Technical Details** Attackers exploit memory-safety flaws triggered by specially crafted JPEG files processed by PHP’s getimagesize and iptcembed functions. The vulnerabilities reside in the ext/standard extension and allow heap memory disclosure or denial-of-service attacks. No CVE identifiers, malware, or infrastructure details are mentioned. The attack vector is untrusted image file input, impacting the exploitation and impact stages of the kill chain. **Recommended Response** Apply patches from PHP maintainers addressing the ext/standard extension vulnerabilities immediately once available. Implement input validation and restrict processing of untrusted JPEG files where possible. Monitor for anomalous image processing activity and potential denial-of-service symptoms. No specific IOCs or detection signatures are provided in the articles.

Source articles (2)

• Crafted JPEGs Could Trigger PHP Memory Bugs for Exploitation — Gbhackers · 2026-05-18
  PHP, one of the most widely used web programming languages, is rarely viewed as a direct attack surface at its core level. Security focus typically shifts toward frameworks and third-party libraries.…
• Malicious JPEG Images Could Trigger PHP Memory Safety Vulnerabilities — Cybersecuritynews · 2026-05-16
  Two critical memory-safety vulnerabilities in PHP’s image-processing functions could allow attackers to leak sensitive heap memory or to execute denial-of-service attacks via specially crafted JPEG fi…

Timeline

• 2026-05-16 — Vulnerabilities disclosed by researcher: Nikita Sveshnikov from Positive Technologies revealed critical memory-safety vulnerabilities in PHP's image-processing functions.
• 2026-05-18 — Gbhackers reports on vulnerabilities: Gbhackers published an article discussing the implications of the vulnerabilities and the risks associated with PHP's built-in functionality.

Related entities

• DDoS (Attack Type)
• Zero-day Exploit (Attack Type)
• PHP (Platform)