CVE-2014-8142

Status: ModifiedHigh (7.5)—PoC
Severity7.5High · CVSS 2.0
Exploitation probability53 %higher than 99% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailableProof of concept on GitHub (unverified)
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
CVSS

Base score: 7.5
Version: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 53 %
Percentile among all scored CVEs: 99
Score date: 10/21/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.
Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub
⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.
Affected technologies (1)

PHP — PHP
CWEs

NVD-CWE-Other
References

Show 34 references
Raw JSON (NVD)

Show
{
  "id": "CVE-2014-8142",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-20T11:59:00.057",
  "references": [
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=143748090628601&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://php.net/ChangeLog-5.php",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3117",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/71791",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=68594",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201503-03",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=143748090628601&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://php.net/ChangeLog-5.php",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3117",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/71791",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=68594",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201503-03",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de uso después de liberación en la función process_nested_data en core/dom/ProcessingInstruction.cpp en ext/standard/var_unserializer.re en PHP anterior a 5.4.36, 5.5.x anterior a 5.5.20, y 5.6.x anterior a 5.6.4, permite a atacantes remotos ejecutar código arbitrario mediante una petición manipulada no serializada que aprovecha un tratamiento incorrecto de las claves duplicadas sin sin las propiedades serializadas de un objeto, una vulnerabilidad diferente de CVE-2004-1019."
    }
  ],
  "lastModified": "2026-06-17T00:16:21.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "039D6C9C-C3EA-434C-ADD0-CFFBAD9CFE0E",
              "versionEndIncluding": "5.4.35"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F6D9B19-E64D-4BED-9194-17460CE19E6F"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D25E591-448C-4E3B-8557-6E48F7571796"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AF783C9-26E7-4E02-BD41-77B9783667E3"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AEDF6F7-001D-4A35-A26F-417991AD377F"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4031DB99-B4B4-41EC-B3C1-543D92C575A9"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5450EA7-A398-49D2-AA8E-7C95B074BAB1"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB8E09D8-9CBE-4279-88B7-24A214A5A537"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D41ECCE-887D-49A2-9BB3-B559495AC55B"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79B418BC-27F4-4443-A0F7-FF4ADA568C1B"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F644EA6C-50C6-4A1C-A4AC-287AA9477B46"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DD47F30-74F5-48E8-8657-C2373FE2BD22"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C09527B-6B47-41F8-BDE6-01C47E452286"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E454D87-23CB-4D7F-90FE-942EE54D661F"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130E50C1-D209-4CFF-9399-69D561340FBB"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1F29948-9417-460B-8B04-D91AE4E8B423"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A37D00C1-4F41-4400-9CE4-8E8BAA3E4142"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "093D08B7-CC3C-4616-8697-F15B253A7D9A"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9CD8FEE-DE7B-47CB-9985-4092BFA071D0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A30B2D9E-F289-43C9-BFBC-1CEF284A417E"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AEAC9BA-AF82-4345-839C-D339DCB962A7"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EFE682F-52E3-48EC-A993-F522FC29712F"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "840EE3AC-5293-4F33-9E2C-96A0A2534B02"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C0FC407-96DB-425E-BB57-7A5BA839C37F"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3839C81-3DAB-4E1D-9D95-BEFFD491F43D"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC63A449-5D92-4F5F-8186-B58FFFBA54FE"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F18236F6-2065-4A6A-93E7-FD90E650C689"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE65D0D4-CB56-4946-AB44-2EF554602A96"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BF4E8FF-A3EC-43E8-A0C1-FD38AFCB77B8"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54ADECFC-3C07-43BC-B296-6C25AC7F1C95"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE192054-2FBB-4388-A52A-422E20DEA2D7"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0195D48-3B42-4AC0-B9C5-436E01C63879"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF0E5D67-ABC1-41A5-94E1-7DD3CDB51D81"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "319E0573-B1AD-40B6-B4BC-8BE67ED3EFDB"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A7C00EB-87B7-4EB7-A4AC-8665D8C78467"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21BFCF10-786A-4D1E-9C37-50A1EC6056F1"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95A6D6C8-5F46-4897-A0B0-778631E8CE6A"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1F13E2D-A8F7-4B74-8D03-7905C81672C9"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE18933A-5FE6-41C7-B1B6-DA3E762C3FB6"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AE1289F-03A6-4621-B387-5F5ADAC4AE92"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/416.html\">CWE-416: Use After Free</a>",
  "sourceIdentifier": "secalert@redhat.com"
}