CVE-2005-0525: The php_next_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimag...

Security readout for executives and security teams

This CVE is an old PHP denial-of-service flaw. If a vulnerable PHP application processes an attacker-supplied JPEG with getimagesize(), PHP can enter an infinite loop and consume service capacity. It is not described as data theft or code execution in the provided sources. Exposure is most likely in legacy PHP applications that inspect uploaded or remote JPEG images using getimagesize(). Modern systems are unlikely to run these exact PHP versions, but unmanaged embedded, appliance, or old hosting environments may still matter. Address this as a legacy exposure cleanup item unless a vulnerable image-upload path is internet-facing. It can disrupt service availability, but the provided evidence does not support code execution, data compromise, or known active exploitation. Mitigation focus: Inventory systems for PHP 4.2.2, 4.3.9, 4.3.10, and 5.0.3.; Check the referenced vendor advisories for applicable fixed packages.; Prioritize internet-facing upload or image-processing workflows..

Prepared

Jun 29, 2026, 22:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.