CVE-2025-14178: Heap buffer overflow in array_merge()
Fixed (Heap buffer overflow in arraymerge()). (CVE-2025-14178)
Other sources
In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1, a heap buffer overflow occurs in arraymerge() when the total element count of packed arrays exceeds 32-bit limits or HTMAXSIZE, due to an integer overflow in the precomputation of element counts using zendhashnumelements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.34 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.34 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.30 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.29 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.16 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14178?
CVE-2025-14178 has a high severity due to the potential for a heap buffer overflow.
How do I fix CVE-2025-14178?
To fix CVE-2025-14178, upgrade to PHP version 8.1.34 or later.
What issue does CVE-2025-14178 address?
CVE-2025-14178 addresses a heap buffer overflow vulnerability in the array_merge() function.
Which versions of PHP are affected by CVE-2025-14178?
CVE-2025-14178 affects PHP versions prior to 8.1.34.
Is there a patch available for CVE-2025-14178?
Yes, the patch for CVE-2025-14178 is included in PHP version 8.1.34.