CVE-2014-9652

CVE-2014-9652 describes an out-of-bounds memory access vulnerability in the mconvert function of the 'file' utility (before version 5.21) and its integration within PHP (versions before 5.4.37, 5.5.21, and 5.6.5). This flaw, stemming from improper handling of string-length fields during Pascal string truncation, could allow a remote attacker to trigger a denial of service by providing a specially crafted file. With a CVSS score of 5.0, this vulnerability is of medium severity, requiring no authentication and having low attack complexity, but only leading to an application crash. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it is not a widely targeted threat.