Bug 2425625 (CVE-2025-14178) - CVE-2025-14178 php: heap-based buffer overflow in array_merge()
Summary: CVE-2025-14178 php: heap-based buffer overflow in array_merge()
Keywords:
Status: NEW
Alias: CVE-2025-14178
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-27 20:01 UTC by OSIDB Bzimport
Modified: 2025-12-29 20:51 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-12-27 20:01:08 UTC 
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
Note You need to log in before you can comment on or make changes to this bug.