CVE-2025-14178 Heap buffer overflow in array_merge()