CVE-2014-9653: readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21,...

Security readout for executives and security teams

This flaw affects the file utility’s ELF parsing code and PHP’s Fileinfo component when they inspect a crafted ELF file. A remote attacker could trigger a denial of service through uninitialized memory access. The sources also mention possible unspecified impact, but do not substantiate code execution or active exploitation. Exposure is most likely in systems that run old file/libmagic packages or unsupported PHP branches and inspect user-supplied files, especially upload workflows using PHP Fileinfo. Modern maintained distributions are likely patched, but legacy appliances or bundled runtimes may still carry this code. Prioritize remediation where old PHP or file/libmagic processes customer-supplied files. This is not KEV-listed in the provided data, so urgency is below actively exploited critical issues, but it remains relevant for legacy internet-facing upload services. Mitigation focus: Upgrade file/libmagic to 5.22 or later where applicable.; Upgrade PHP to at least 5.4.37, 5.5.21, or 5.6.5 where applicable.; Prefer currently supported PHP and OS vendor packages..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.