CVE-2025-14178 is a heap-based buffer overflow vulnerability in PHP's array_merge() function. It occurs when the total element count of packed arrays exceeds 32-bit integer limits or HT_MAX_SIZE, triggering an integer overflow during the precomputation of element counts via zend_hash_num_elements(). This vulnerability can lead to memory corruption or application crashes, affecting the integrity and availability of the affected system. The issue affects PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, and 8.5.* before 8.5.1. Red Hat Product Security has issued an official security advisory (RHSA-2026:1187) with patches for Red Hat Enterprise Linux 9.6 Extended Update Support. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability may result in memory corruption or crashes of the PHP process, potentially leading to denial of service and impacting the integrity and availability of the target server. There is no indication of remote code execution or data disclosure from the provided information. The severity is rated as high by the source, reflecting the potential for service disruption.

An official security update addressing this vulnerability is available from Red Hat as part of the php:8.2 module update for Red Hat Enterprise Linux 9.6 Extended Update Support. Users should apply the vendor-provided patches promptly to remediate the issue. For detailed update instructions, refer to the Red Hat advisory RHSA-2026:1187 and the linked article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official fix.