CVE-2016-4544: The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7....

Security readout for executives and security teams

This is a PHP image-metadata parsing flaw. A specially crafted JPEG header could crash vulnerable PHP processes when EXIF handling parses embedded TIFF data. The public record mainly supports denial of service; it also notes possible unspecified impact without details. Exposure is most likely in applications running vulnerable PHP versions with ext/exif enabled and processing user-supplied or remote JPEG files. The bundle does not identify specific downstream products beyond PHP and distribution advisories. Treat this as a targeted stability risk for legacy PHP image-processing services. It is not KEV-listed, but internet-facing upload paths on old PHP should be remediated promptly because crashing workers can affect availability. Mitigation focus: Upgrade PHP to at least 5.5.35, 5.6.21, 7.0.6, or supported vendor-fixed packages.; Prioritize systems that parse uploaded, emailed, or externally fetched JPEG images.; If upgrade timing is constrained, reduce untrusted EXIF parsing until vendor guidance is applied..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.