This advisory covers two security vulnerabilities in PHP 8.2 as packaged by Red Hat for Red Hat Enterprise Linux 9.4 EUS. The first vulnerability (CVE-2025-14178) is a heap-based buffer overflow in the array_merge() function, which could lead to memory corruption. The second vulnerability (CVE-2025-14180) involves a denial of service caused by an invalid character sequence in PDO PostgreSQL prepared statements. Red Hat has released updated PHP 8.2 packages that address these issues. The advisory references Red Hat Bugzilla entries BZ-2425625 and BZ-2425627 for the respective fixes. No CVSS score is provided in the advisory, but the severity is rated as Important.

The heap-based buffer overflow in array_merge() could potentially lead to memory corruption, which may affect application stability or security depending on exploitability. The denial of service vulnerability in PDO PostgreSQL prepared statements can cause application crashes or service interruptions when processing invalid character sequences. Both vulnerabilities impact PHP 8.2 installations on Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated PHP 8.2 packages that fix these vulnerabilities. Users should apply the security update for the php:8.2 module as described in the Red Hat advisory RHSA-2026:1169 and the update instructions at https://access.redhat.com/articles/11258. Applying this update will remediate the heap-based buffer overflow and denial of service issues. No additional mitigation steps are indicated or required beyond applying the official update.