CVE-2025-14178

CWE-190 — Integer OverflowCWE-787 — Out-of-bounds Write9 documents8 sources
Severity
8.2HIGH
EPSS
0.0%
top 94.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PHP Group PHPPHP PHP
Timeline
PublishedDec 27
Latest updateJan 12

Description

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HExploitability: 2.2 | Impact: 4.2

Affected Packages5 packages

▶NVDphp/php8.1.0 — 8.1.34+4
▶CVEListV5php_group/php8.1.* — 8.1.34+4
▶Debianphp7.4< 7.4.33-1+deb11u10
▶Debianphp8.2< 8.2.30-1~deb12u1
▶Debianphp8.4< 8.4.16-1~deb13u1+1

🔴Vulnerability Details

3
OSV
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities↗2026-01-12
▶
OSV
CVE-2025-14178: In PHP versions:8↗2025-12-27
▶
CVEList
Heap buffer overflow in array_merge()↗2025-12-27
▶

📋Vendor Advisories

4
Ubuntu
PHP vulnerabilities↗2026-01-12
▶
Red Hat
php: heap-based buffer overflow in array_merge()↗2025-12-27
▶
Microsoft
Heap buffer overflow in array_merge()↗2025-12-09
▶
Debian
CVE-2025-14178: php7.4 - In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-14178 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶