Malicious JPEG Images Could Trigger PHP Memory Safety Vulnerabilities

**Executive summary:** Two critical memory-safety flaws in PHP's ext/standard image-processing functions were disclosed: CVE-2025-14177 allows leakage of uninitialized heap memory via getimagesize when processing large multi-chunk JPEG APP segments, and a heap buffer overflow in iptcembed can be triggered by streams (e.g., FIFOs) or oversized input causing out-of-bounds writes; both have practical PoCs and patches are available for affected PHP 8.1–8.5 series.