CVE-2014-1439: The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PH...

Security readout for executives and security teams

CVE-2014-1439 affects HHVM PHP runtime versions before 2.4.0 and 2.3.x before 2.3.3. A libxml setting intended to disable external entity loading did not fully disable the relevant handler, allowing remote attackers to trigger XXE behavior. Business risk depends on whether HHVM processes attacker-supplied XML. Exposure is most likely in legacy HHVM deployments that parse XML from users, partners, integrations, or APIs. Organizations not running HHVM, or not processing untrusted XML through affected HHVM versions, are unlikely to be exposed based on the provided evidence. Prioritize if the organization still runs legacy HHVM with externally supplied XML. The issue is old and not listed as KEV, but XXE can affect sensitive files, internal services, or data exposure depending on parser reachability. Mitigation focus: Inventory HHVM use and identify versions before 2.4.0 or 2.3.3.; Upgrade affected HHVM deployments to a fixed vendor release where supported.; Review HHVM vendor guidance and the referenced fixing commit before changing production systems..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.