UpHeron
All vulnerabilities

Servers and applications

CVE-2025-14178

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes…

Severity
High 8.2
Published
27 Dec 2025
Last changed
13 Oct 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.1.0 before 8.1.34
  • From 8.2.0 before 8.2.30
  • From 8.3.0 before 8.3.29
  • From 8.4.0 before 8.4.16
  • From 8.5.0 before 8.5.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-14178
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14178