This Red Hat security advisory addresses two vulnerabilities in PHP 8.2: CVE-2025-14178, a heap-based buffer overflow in the array_merge() function, and CVE-2025-14180, a denial of service vulnerability triggered by an invalid character sequence in PDO PostgreSQL prepared statements. These issues affect multiple Red Hat Enterprise Linux 9.6 Extended Update Support variants and related PHP packages. The advisory provides updated packages that fix these vulnerabilities. The vulnerabilities are rated as important by Red Hat Product Security, with a high severity level indicated. No CVSS base score is provided in the advisory, and no known exploits in the wild have been reported. The advisory includes detailed package information and references for applying the update.

The heap-based buffer overflow (CVE-2025-14178) could lead to memory corruption, potentially allowing an attacker to cause application crashes or execute arbitrary code if exploited. The denial of service vulnerability (CVE-2025-14180) could allow an attacker to disrupt service by causing the PHP process to crash when processing specially crafted invalid character sequences in PDO PostgreSQL prepared statements. Both vulnerabilities affect PHP 8.2 running on Red Hat Enterprise Linux 9.6 Extended Update Support and related packages. No known exploits in the wild have been reported at this time.

Red Hat has released updated PHP 8.2 packages that address these vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 9.6 Extended Update Support should apply the security update as described in the Red Hat advisory RHSA-2026:1187 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate the heap-based buffer overflow and denial of service vulnerabilities. There is no indication that additional mitigation steps are required beyond applying the official patches.