CVE-2025-14178

A flaw was found in PHP. A heap-based buffer overflow occurs in the array_merge function when the total element count of packed arrays exceeds the 32-bit limit or the internal HT_MAX_SIZE due to an integer overflow in the precomputation of element counts using the zend_hash_num_elements function, causing a process crash and potentially memory corruption.

To exploit this issue, an attacker must be able to pass arrays to array_merge() containing a very large number of elements, specifically the total element count must exceed the 32-bit integer limit or the internal HT_MAX_SIZE constant. Creating such a massive array often triggers the memory limit of PHP and the system, causing an out-of-memory condition before the buffer overflow can be triggered, increasing the complexity of exploitation.

Also, default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and memory protections significantly increase the difficult of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.