CVE-2025-14178CWE-190CWE-787

CVE-2025-14178

Medium · published December 28, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00459 · 38.8th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-787 · Out-of-bounds Write
Published
2025-12-28T01:15Z
Affected products (5)
ProductVersionsFixed in
php/php≥ 8.1.0, < 8.1.348.1.34
php/php≥ 8.2.0, < 8.2.308.2.30
php/php≥ 8.3.0, < 8.3.298.3.29
php/php≥ 8.4.0, < 8.4.168.4.16
php/php≥ 8.5.0, < 8.5.18.5.1
References (2)
https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2 · [email protected]https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 DEC 19:27Z
    Heap buffer overflow in array_merge()
    cvelistv5