CVE-2014-9425: Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engin...

Security readout for executives and security teams

CVE-2014-9425 is a memory-management flaw in PHP’s Zend Engine. A remote attacker could cause affected PHP processes to crash, disrupting PHP-backed websites or services. The sources do not provide a CVSS score, exploit details, or confirmed active exploitation. Exposure is most likely on legacy systems running affected PHP 5.5 or 5.6 builds, including vendor-packaged PHP in operating systems or appliances referenced by downstream advisories. Handle as a legacy exposure cleanup item with higher priority for public-facing PHP services. Lack of confirmed exploitation lowers urgency, but unsupported PHP versions increase operational risk. Mitigation focus: Inventory systems running PHP 5.5 or 5.6.; Check PHP, OS, and appliance vendor advisories for fixed packages.; Upgrade affected PHP packages using vendor-supported update channels..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.