This advisory covers two security fixes in PHP distributed with Red Hat Enterprise Linux 10.0 EUS. The first vulnerability (CVE-2025-14178) is a heap-based buffer overflow in the array_merge() function, which could lead to memory corruption. The second (CVE-2025-14180) is a denial of service vulnerability triggered by invalid character sequences in PDO PostgreSQL prepared statements. Red Hat has released updated PHP packages to address these issues. The advisory references Red Hat Bugzilla entries for the fixes and directs users to official update instructions. No CVSS base scores are provided in the advisory, and no exploits are currently known in the wild.

The heap-based buffer overflow could potentially allow an attacker to cause memory corruption, which may lead to application crashes or other unpredictable behavior. The denial of service vulnerability could allow an attacker to disrupt PHP applications using PDO PostgreSQL by sending invalid character sequences, causing service interruptions. Both vulnerabilities affect PHP installations on Red Hat Enterprise Linux 10.0 Extended Update Support. No evidence of active exploitation has been reported.

Red Hat has released updated PHP packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated in the advisory.