CVE-2014-4049: Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier...

Security readout for executives and security teams

This is an old PHP DNS parsing flaw. If vulnerable PHP code asks a hostile or compromised DNS server for a TXT record, PHP may crash and could potentially run attacker-controlled code. Business urgency is mainly for legacy systems still running PHP 5.6.0beta4 or earlier, or vendor products that embedded vulnerable PHP. Exposure is most likely in legacy PHP deployments at 5.6.0beta4 or earlier, especially applications that call dns_get_record against domains controlled by users, partners, or untrusted infrastructure. Modern supported PHP versions are unlikely to be affected, but embedded PHP in old vendor stacks needs confirmation. Treat this as a legacy exposure cleanup item with high impact if present. It is not KEV-listed in the provided bundle, but affected PHP can crash and may allow code execution. Prioritize discovery first; urgent remediation is warranted only where vulnerable PHP still exists. Mitigation focus: Identify any PHP 5.6.0beta4 or earlier runtimes and retire or upgrade them.; Review vendor advisories for packaged PHP fixes in affected operating systems or products.; Prioritize internet-facing applications that query DNS TXT records from untrusted inputs..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.