CVE-2014-0236: PHP

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.

Affected products

• PHP PHP: up to and including 5.5.35

Published 2016-05-16. Last modified 2026-06-17.