What is CVE-2014-3478?

CVE-2014-3478 is a medium-severity vulnerability in Christos Zoulas File, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.5/10. Published 2014-07-09.

How severe is CVE-2014-3478?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2014-3478 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Christos Zoulas File

CVE-2014-3478

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

Vulnerability class: Buffer Overflow

Published 2014-07-09 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.152 (96.6th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.152 · newest: 0.152 · change: 0.000

Affected products

Christos Zoulas File — versions 5.00, 5.01, 5.02
PHP — versions 5.4.0, 5.4.1, 5.4.2

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

support.apple.com/HT204659
rhn.redhat.com/errata/RHSA-2014-1766.html (vendor-advisory)
www.debian.org/security/2014/dsa-3021 (vendor-advisory)
marc.info/ (vendor-advisory)
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
www.debian.org/security/2014/dsa-2974 (vendor-advisory)
secunia.com/advisories/59794 (third-party-advisory)
www.php.net/ChangeLog-5.php
mx.gw.com/pipermail/file/2014/001553.html (mailing-list)
github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08 (Exploit, Patch)

Frequently asked questions

What is CVE-2014-3478?: CVE-2014-3478 is a medium-severity vulnerability in Christos Zoulas File, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.5/10. Published 2014-07-09.
How severe is CVE-2014-3478?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2014-3478 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.