CVE-2014-8142: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP...

Security readout for executives and security teams

CVE-2014-8142 is a memory-safety flaw in older PHP versions. If an application passes attacker-controlled data into PHP unserialize, a crafted object can trigger use-after-free behavior and may allow arbitrary code execution. Business urgency is highest for legacy PHP systems that still deserialize untrusted input. Exposure is mainly legacy PHP 5.x deployments below the fixed versions, especially applications, frameworks, or bundled products that call unserialize on data an attacker can influence. The source bundle lists multiple distribution advisories, suggesting downstream packaging exposure, but it does not prove any specific asset is affected. Prioritize remediation where legacy PHP is internet-facing or processes user-supplied serialized data. The issue is old and fixed, but arbitrary code execution impact makes unsupported PHP estates the main business risk. If PHP versions are current, urgency drops sharply. Mitigation focus: Upgrade PHP to 5.4.36, 5.5.20, 5.6.4, or a supported later release.; Apply relevant vendor distribution advisories for packaged PHP builds.; Audit application paths that pass user-controlled data into unserialize..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.