Read the docs
TI-2025-12956 Aliases CVE-2025-14178

Heap buffer overflow in array_merge()

Priority HIGH 69CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Fixed PHP (PHP Group): 8.1.34, 8.2.30, 8.3.29 +2Red Hat: 18 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHPbefore 8.1.34; before 8.2.30; before 8.3.29; before 8.4.16; before 8.5.18.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1Patch availableCNA
  • PHP VendorPHP Group Affected before 8.1.34; before 8.2.30; before 8.3.29; before 8.4.16; before 8.5.1 Fixed in 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*8.1.0 to before 8.1.34; 8.2.0 to before 8.2.30; 8.3.0 to before 8.3.29; 8.4.0 to before 8.4.16; 8.5.0 to before 8.5.1VulnerablePHP
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 8.1.0 to before 8.1.34; 8.2.0 to before 8.2.30; 8.3.0 to before 8.3.29; 8.4.0 to before 8.4.16; 8.5.0 to before 8.5.1 Vulnerable ·PHP

Remediation

  • Fix · CNA PHP (PHP Group) Fixed in 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1

Red Hat 18 advisories

  • RHSA-2026:7614 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images php-8.5.5-1.1.hum1@aarch64, php-8.5.5-1.1.hum1@src, php-8.5.5-1.1.hum1@x86_64 +47
  • RHSA-2026:4517 Released 2026-03-12 · Red Hat rating Moderate
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
  • RHSA-2026:4514 Released 2026-03-12 · Red Hat rating Moderate
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
Show 15 more Red Hat advisories
  • RHSA-2026:4507 Released 2026-03-12 · Red Hat rating Moderate
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
  • RHSA-2026:4266 Released 2026-03-11 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) php-8.0.30-1.el9_2.1, php-bcmath-8.0.30-1.el9_2.1, php-cli-8.0.30-1.el9_2.1 +22
  • RHSA-2026:4212 Released 2026-03-10 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) php-8.0.13-2.el9_0.1, php-bcmath-8.0.13-2.el9_0.1, php-cli-8.0.13-2.el9_0.1 +22
  • RHSA-2026:4086 Released 2026-03-09 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) php-8.0.30-3.el9_6.1, php-bcmath-8.0.30-3.el9_6.1, php-cli-8.0.30-3.el9_6.1 +22
  • RHSA-2026:4077 Released 2026-03-09 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) php-8.0.30-1.el9_4.1, php-bcmath-8.0.30-1.el9_4.1, php-cli-8.0.30-1.el9_4.1 +22
  • RHSA-2026:2799 Released 2026-02-17 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux AppStream (v. 9) php-8.0.30-5.el9_7, php-bcmath-8.0.30-5.el9_7, php-cli-8.0.30-5.el9_7 +22
  • RHSA-2026:2470 Released 2026-02-10 · Red Hat rating Moderate
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.10.0+22485+a3539972.noarch::php:7.4, libzip-1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4, libzip-1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4 +47
  • RHSA-2026:1628 Released 2026-02-02 · Red Hat rating Important
    php security update
    • Red Hat Enterprise Linux AppStream (v. 10) php-8.3.29-1.el10_1, php-bcmath-8.3.29-1.el10_1, php-cli-8.3.29-1.el10_1 +22
  • RHSA-2026:1429 Released 2026-01-27 · Red Hat rating Important
    php:8.3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.29-1.module+el9.7.0+23852+76de6b03.aarch64::php:8.3, php-8.3.29-1.module+el9.7.0+23852+76de6b03.ppc64le::php:8.3 +47
  • RHSA-2026:1409 Released 2026-01-27 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.4.0+20748+b46899d2.noarch::php:8.2, php-8.2.30-1.module+el9.7.0+23849+7b831f17.aarch64::php:8.2, php-8.2.30-1.module+el9.7.0+23849+7b831f17.ppc64le::php:8.2 +47
  • RHSA-2026:1412 Released 2026-01-27 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.23-1.module+el8.10.0+20770+a5eca186.noarch::php:8.2, libzip-1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2, libzip-1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2 +47
  • RHSA-2026:1190 Released 2026-01-26 · Red Hat rating Important
    php:8.3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.19-1.module+el9.6.0+23891+2c64b922.2.aarch64::php:8.3, php-8.3.19-1.module+el9.6.0+23891+2c64b922.2.ppc64le::php:8.3 +47
  • RHSA-2026:1187 Released 2026-01-26 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) apcu-panel-5.1.23-1.module+el9.4.0+20748+b46899d2.noarch::php:8.2, php-8.2.28-1.module+el9.6.0+23892+f0eec4a0.2.aarch64::php:8.2, php-8.2.28-1.module+el9.6.0+23892+f0eec4a0.2.ppc64le::php:8.2 +47
  • RHSA-2026:1185 Released 2026-01-26 · Red Hat rating Important
    php security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) php-8.3.19-1.el10_0.1, php-bcmath-8.3.19-1.el10_0.1, php-cli-8.3.19-1.el10_0.1 +22
  • RHSA-2026:1169 Released 2026-01-26 · Red Hat rating Important
    php:8.2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) apcu-panel-5.1.23-1.module+el9.4.0+20748+b46899d2.noarch::php:8.2, php-8.2.13-1.module+el9.4.0+23893+7c48bdfc.2.aarch64::php:8.2, php-8.2.13-1.module+el9.4.0+23893+7c48bdfc.2.ppc64le::php:8.2 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP 8.1.34, 8.2.30 and 3 more versions

    3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2025-12958 NULL Pointer Dereference in PDO quotingPriority HIGH 69
    • TI-2025-12955 Information Leak of Memory in getimagesizePriority MEDIUM 61
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:1628
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:1412, RHSA-2026:2470
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:1409, RHSA-2026:1429, RHSA-2026:2799
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:4507
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:4517
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:4517
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:4514
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:4212
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:4266
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:1185
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:1169, RHSA-2026:4077
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:1187, RHSA-2026:1190, RHSA-2026:4086
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:4507
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:4517
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:4514
Red Hat Hardened ImagesFixed RHSA-2026:7614
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14178

References

Advisory 1

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences