CVE-2014-0236: file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a...

Security readout for executives and security teams

A crafted CDF file can crash applications that rely on vulnerable file type detection code. The business impact is denial of service, not confirmed data theft or code execution. Exposure matters most where users or remote systems can submit files for inspection by PHP Fileinfo or the file library. Likely exposure is legacy PHP applications using Fileinfo before PHP 5.6.0, or systems using file before 5.18, especially on file upload, attachment scanning, MIME detection, or content classification paths. Treat this as a legacy availability risk. It is most urgent for internet-facing upload or attachment-processing systems still running old PHP or file components. No source provided indicates active exploitation or data compromise. Mitigation focus: Inventory PHP Fileinfo and file library versions in production and build images.; Replace PHP before 5.6.0 and file before 5.18 where still present.; Review vendor guidance and distribution backports before assuming version numbers alone prove exposure..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.