CVE-2014-3487: The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5....

Security readout for executives and security teams

This is an older denial-of-service issue in file type detection. If a vulnerable system inspects a specially crafted CDF document, the parser can crash the application. The practical business impact is availability loss for services that accept or scan user-supplied files, not confirmed data theft or code execution. Exposure is most likely in legacy PHP or libmagic/file deployments that process uploaded, emailed, or otherwise untrusted documents. Current exposure depends on whether file/libmagic or PHP Fileinfo remains at the vulnerable versions named in the CVE sources. Prioritize remediation for internet-facing upload or document-processing services still running legacy PHP or file/libmagic. For modern, patched platforms this should be tracked as legacy hygiene rather than an emergency, because the known impact is application crash and active exploitation is not evidenced here. Mitigation focus: Upgrade file/libmagic to 5.19 or later where applicable.; Upgrade PHP to 5.4.30, 5.5.14, or later supported versions.; Apply vendor security updates from your operating system distribution..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.