CVE-2025-14178: 
PHP vulnerability analysis and mitigation

CVE-2025-14178 is a heap buffer overflow vulnerability in PHP's array_merge() function caused by an integer overflow when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE. It affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1. The vulnerability was published on December 27, 2025, with the GitHub Security Advisory (GHSA-h96m-rvf9-jgm2) published by the PHP project on December 18, 2025. It carries a CVSS v3.1 base score of 8.2 (High) (PHP Advisory, Feedly).

The root cause is an integer overflow (CWE-190) in the precomputation of element counts within array_merge(), specifically in the expression count += zend_hash_num_elements(Z_ARRVAL_P(arg)), which can overflow a 32-bit integer when merging many large packed arrays. This overflow leads to an out-of-bounds write (CWE-787) — a heap buffer overflow — when the computed count exceeds HT_MAX_SIZE. The vulnerability is exploitable remotely over the network with no authentication or user interaction required, and attack complexity is low. A concrete PoC trigger is: $arr = range(0, 2**29); array_merge($arr, $arr, $arr, $arr, $arr, $arr, $arr, $arr);, or more generally by crafting JSON data decoded into arrays whose combined element count exceeds the 32-bit limit before being passed to array_merge(). The bug has been present in PHP since version 7.1 (PHP Advisory).

Successful exploitation can result in heap memory corruption or application crashes, affecting both the integrity and availability of the target PHP server. In memory-safe environments the impact would be limited to denial of service (DoS), but in PHP's C runtime, heap corruption opens the door to potential arbitrary code execution or unpredictable process behavior. Confidentiality impact is assessed as none, integrity impact as low, and availability impact as high per the CVSS scoring (PHP Advisory, Feedly).

A proof-of-concept exploit trigger is publicly documented in the official PHP security advisory, and a GitHub repository (gl1tch0x1/PHP_8.1.x_Exploit) referencing exploitation of this vulnerability has been observed (PHP Advisory, Feedly). There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.04% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify target servers running vulnerable PHP versions (8.1.x < 8.1.34, 8.2.x < 8.2.30, 8.3.x < 8.3.29, 8.4.x < 8.4.16, 8.5.x < 8.5.1) via version disclosure in HTTP headers, error pages, or banner grabbing tools.
2. Craft malicious input: Prepare a JSON payload that, when decoded via json_decode(), produces multiple arrays whose combined element count exceeds HT_MAX_SIZE (approximately 2^31) or the 32-bit integer limit. For example, a JSON structure like [array1, array2, ...] where each array has ~2^29 elements and 8 or more arrays are merged.
3. Deliver payload: Submit the crafted JSON to a vulnerable PHP application endpoint that accepts user-supplied JSON and passes the decoded arrays to array_merge() — e.g., via an HTTP POST request with a large JSON body.
4. Trigger overflow: The server-side PHP code calls array_merge(...$decoded_arrays), causing the integer overflow in zend_hash_num_elements() precomputation, resulting in a heap buffer overflow.
5. Achieve impact: Depending on heap layout and PHP build, the outcome ranges from a process crash (DoS) to potential heap corruption enabling further exploitation (PHP Advisory).

• Network: Unusually large HTTP POST requests (multi-gigabyte or abnormally large JSON bodies) sent to PHP application endpoints; repeated requests causing PHP-FPM or web server worker crashes.
• Logs: PHP error logs showing fatal errors, segmentation faults, or memory corruption messages originating from array_merge() calls; web server logs showing 500 errors or worker restarts correlated with large request bodies.
• Process: Unexpected PHP-FPM worker process crashes or restarts; core dump files generated by the PHP process in the working directory or /tmp.
• File System: Presence of core dump files (e.g., core.*) in PHP process working directories following application crashes.

Upgrade PHP to the patched versions: 8.1.34, 8.2.30, 8.3.29, 8.4.16, or 8.5.1 depending on the branch in use. As a temporary workaround, restrict or validate the number and size of arrays passed to array_merge() in application code, and limit the size of user-supplied JSON inputs processed by the application. Network-level controls such as request body size limits (e.g., client_max_body_size in Nginx or LimitRequestBody in Apache) can reduce exposure. Linux distribution vendors including Red Hat, Debian, Ubuntu, SUSE, Slackware, Mageia, and Alpine Linux have released updated packages (PHP Advisory, Red Hat, Ubuntu Advisory).

The PHP project's security team (bukka) published the advisory on December 18, 2025, noting the bug has existed since PHP 7.1 and highlighting that real-world exploitation could occur via crafted JSON data passed to array_merge(). Multiple Linux distribution vendors (Red Hat, Debian, Ubuntu, SUSE, Slackware, Alpine, Mageia) issued security advisories and updated packages promptly. Security scanning vendors Tenable (Nessus) and Qualys added detection plugins shortly after disclosure. Community coverage appeared on security blogs and Linux news aggregators, with the vulnerability described as a significant memory safety issue in PHP's array handling (PHP Advisory).