Threats tagged 'bit-php-2025-14178'

A heap buffer overflow vulnerability exists in the PHP array_merge() function in versions prior to 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1. The flaw occurs due to an integer overflow in element count precomputation when merging packed arrays with a total element count exceeding 32-bit limits or HT_MAX_SIZE. This can lead to memory corruption or crashes, affecting server integrity and availability. Red Hat has released security updates addressing this issue in their PHP packages for Red Hat Enterprise Linux 9.6 Extended Update Support.