Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-14178

Good to know:

icon
icon

Date: December 27, 2025

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

Severity Score

Related Resources (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-14178
https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2
https://www.mend.io/vulnerability-database/CVE-2025-14178

Severity Score

Weakness Type (CWE)

Integer Overflow or Wraparound

CWE-190

Out-of-bounds Write

CWE-787

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/php/php-src.git - php-8.5.1;https://github.com/php/php-src.git - php-8.4.16;https://github.com/php/php-src.git - php-8.3.29;https://github.com/php/php-src.git - php-8.2.30;https://github.com/php/php-src.git - php-8.1.34

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): HIGH

Do you need more information?

Contact Us