CVE-2014-9426
** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in...
The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable
Exploit likelihood
What each source reports
CVE List
The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable
- Record
CVE-2014-9426- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2014-9247
The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable
- Record
EUVD-2014-9247- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hcpv-8j4p-29jp
** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in...
** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable.
- Record
GHSA-hcpv-8j4p-29jp- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
NVD
The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable
- Record
CVE-2014-9426- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-17
- Updated
- 2026-11-02
OSVBELL-CVE-2014-9426
CVE-2014-9426 does not affect BellSoft software
- Record
BELL-CVE-2014-9426- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10290-1 No score
apache2-mod_php7-7.0.14-1.4 on GA media
These are all security issues fixed in the apache2-mod_php7-7.0.14-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10290-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10344-1 No score
apache2-mod_php5-5.6.28-1.1 on GA media
These are all security issues fixed in the apache2-mod_php5-5.6.28-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10344-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11169-1 No score
php8-8.0.11-1.1 on GA media
These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11169-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9426 is a high vulnerability (CVSS 7.5) in Php, published December 31, 2014. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile.
References
git.php.net?p=php-src.git%3Ba=commit%3Bh=a72cd07f2983dc43a6bb35209dc4687852e53c09
lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
bugs.php.net/bug.php?id=68665
nvd.nist.gov/vuln/detail/CVE-2014-9426
Show 118 moreShow less
github.com/advisories/GHSA-hcpv-8j4p-29jp
docs.bell-sw.com/security/cves/CVE-2014-9426
suse.com/security/cve/CVE-2006-7243