VulnerabilityModified

CVE-2014-8142

HIGH 7.5EPSS 55.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 55.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 55.06% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Affected: php/php
Source: secalert@redhat.com

EPSS trend

EPSS moved from 55.1% on 22 October 2026 to 55.1% on 4 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.