CVE-2025-14178
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Dec 27, 2025
CISA due date
—
The record
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | libphp | 0 | 8.1.34 |
| Bitnami | php | 0 | 8.1.34 |
| Bitnami | php-min | 0 | 8.1.34 |
| Mageia:9 | php | 0 | 8.2.30-1.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | php7-embed | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | php7-test | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | apache2-mod_php8 | 0 | 8.3.29-150700.3.9.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | php8 | 0 | 8.3.29-150700.3.9.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | php8-embed | 0 | 8.3.29-150700.3.9.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | php8-fastcgi | 0 | 8.3.29-150700.3.9.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | php8-fpm | 0 | 8.3.29-150700.3.9.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | php8-test | 0 | 8.3.29-150700.3.9.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | php7 | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | apache2-mod_php7 | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | apache2-mod_php8 | 0 | 8.2.30-150600.3.25.1 |
| openSUSE:Leap 15.6 | php7 | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | php7-embed | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | php7-fastcgi | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | php7-fpm | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | php7-test | 0 | 7.4.33-150400.4.55.1 |
| openSUSE:Leap 15.6 | php8 | 0 | 8.2.30-150600.3.25.1 |
| openSUSE:Leap 15.6 | php8-embed | 0 | 8.2.30-150600.3.25.1 |
| openSUSE:Leap 15.6 | php8-fastcgi | 0 | 8.2.30-150600.3.25.1 |
| openSUSE:Leap 15.6 | php8-fpm | 0 | 8.2.30-150600.3.25.1 |
| openSUSE:Leap 15.6 | php8-test | 0 | 8.2.30-150600.3.25.1 |
| openSUSE:Leap 16.0 | apache2-mod_php8 | 0 | 8.4.16-160000.1.1 |
| openSUSE:Leap 16.0 | php8 | 0 | 8.4.16-160000.1.1 |
| openSUSE:Leap 16.0 | php8-embed | 0 | 8.4.16-160000.1.1 |
| openSUSE:Leap 16.0 | php8-fastcgi | 0 | 8.4.16-160000.1.1 |
| openSUSE:Leap 16.0 | php8-fpm | 0 | 8.4.16-160000.1.1 |
| openSUSE:Leap 16.0 | php8-test | 0 | 8.4.16-160000.1.1 |
| openSUSE:Tumbleweed | php8 | 0 | 8.4.16-1.1 |
Related vulnerabilities
- CVE-2025-14177 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.*… Also affects libphp
- CVE-2025-14180 In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.*… Also affects libphp
- CVE-2024-11233 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an… Also affects libphp
- CVE-2024-11236 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14… Also affects libphp
- CVE-2024-11234 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using… Also affects libphp
- CVE-2024-8929 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile… Also affects libphp
- CVE-2024-8932 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14… Also affects libphp
- CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using… Also affects libphp