CVE-2014-3587: Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Filei...

Security readout for executives and security teams

This flaw can make software crash when it inspects a specially crafted CDF document. It affects the file utility through 5.19 and PHP Fileinfo before 5.4.32 and 5.5.16. The main business risk is denial of service in systems that process untrusted uploaded or attached files. Most likely exposure is web applications, mail gateways, content scanners, or backend jobs that use vulnerable file/libmagic or PHP Fileinfo to identify untrusted documents. Vendor advisories indicate this reached common Linux distributions and other packaged ecosystems. Treat as a patching priority for file-processing systems, especially public upload portals and mail or content-scanning infrastructure. It is not evidenced as actively exploited, but a simple crash condition can still disrupt customer-facing services. Mitigation focus: Upgrade file/libmagic beyond affected 5.19 builds using vendor packages.; Upgrade PHP Fileinfo to 5.4.32, 5.5.16, or a supported later release.; Apply relevant Debian, Ubuntu, Red Hat, Oracle, or Apple security updates..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.