CVE-2015-8865

No known exploitation. EPSS puts it in the 92nd percentile. A vendor fix is available.

CVSS 3.07.3High EPSS percentile92nd5.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-05-20Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which PHP version your business is running and whether the Fileinfo functionality is used (for example, any app logic that inspects files using PHP’s fileinfo).
If you are on PHP 5.5.34 or older, PHP 5.6.20 or older, or PHP 7.0.5 or older, plan an upgrade to at least PHP 5.5.34, 5.6.20, or 7.0.5 (or newer).
If you rely on PHP bundled with Apple software, update your macOS / OS X to at least 10.11.5 or newer.
After upgrading, test your file-type detection/inspection paths to ensure fileinfo still works and your app remains stable.

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

In plain language

Written by AI from the record

This PHP bug can make your server crash (and, rarely, potentially run unexpected code) if you use the PHP Fileinfo feature with a specially crafted “magic file”; most small businesses should update PHP to the fixed versions if you’re running vulnerable PHP.

In PHP’s Fileinfo component, CVE-2015-8865 is caused by a memory-handling flaw in the file_check_mem function (CWE-119), where mishandled continuation-level jumps in processing a crafted magic file can trigger a denial of service and, in some cases, lead to code execution—an attacker typically needs a path to influence what PHP processes.

If you're affected

Server crashes and downtime
Possible malicious code execution
Service disruption to customers
Incident response and cleanup costs

What is it

PHP’s Fileinfo feature looks at files to figure out what type they are. This bug can be triggered by a “crafted magic file” so that PHP mishandles memory and crashes the process. In rarer cases, it may allow something more serious than a crash, but the most immediate, practical risk for a small business is downtime and service disruption.

Who is affected

This matters if you run PHP on a server or service where the Fileinfo component is used to inspect files (for example, any workflow that processes uploaded files or determines file type). The risk is highest when an attacker can influence what PHP processes so they can feed a specially crafted input into the fileinfo flow. If attackers cannot reach that processing path (for example, they have no practical way to supply the crafted file contents), exposure is less likely.

How urgent is it

This should be treated as a meaningful update, because a vulnerable PHP version can be forced to crash, and crafted inputs can potentially go further than a denial of service. There’s no public exploit code on record for this issue, and it is not listed in CISA’s KEV catalog, but press attention is rising—so you should upgrade on your next available maintenance window with priority.

What to do — in detail

Inventory exposure
- Identify every PHP runtime in use (web servers, app servers, CLI/cron jobs).
- Record PHP versions and confirm whether the Fileinfo-based functionality is enabled/used by your applications (often via PHP’s fileinfo capabilities for MIME/type detection).
Confirm whether you’re on a vulnerable version
- Vulnerable when using PHP:
  - before 5.5.34, or
  - 5.6.x before 5.6.20, or
  - 7.x before 7.0.5.
Upgrade to the fixed versions
- Upgrade the PHP interpreter to at least one of the fixed baselines:
  - 5.5.34 or newer, OR
  - 5.6.20 or newer, OR
  - 7.0.5 or newer.
If you’re using Apple-bundled software
- Update macOS / OS X to 10.11.5 or newer, if that’s where your effective PHP comes from.
Temporary mitigation if you can’t patch immediately
- Reduce or disable any application features that use PHP Fileinfo for processing untrusted or user-supplied files until you can upgrade.
- If your app accepts uploads, ensure you restrict/validate allowed file types and limit how/when file inspection is performed.
Verify after patching
- Run a quick functional test of the code paths that use file-type detection/inspection.
- Watch application health indicators for instability during/after processing uploaded or user-influenced files.
What to monitor
- Application crashes and restarts related to file processing.
- Unusual requests or inputs that trigger file-type detection workflows.

Technical context

CVE-2015-8865 (CWE-119) is a memory-safety flaw in PHP’s fileinfo implementation: the file_check_mem function in funcs.c mishandles continuation-level jumps. This can cause a denial of service (buffer overflow/application crash) when a context-dependent attacker supplies specially crafted inputs via a crafted magic file; in some cases, it may be capable of arbitrary code execution.

Findings summary: there is no CISA KEV entry for this CVE and no public exploit code is on record. Predicted likelihood (EPSS) is given as 5.4% with a flat trend, but this is not treated as proof of real-world exploitation. Press attention has been rising, and the available fix guidance is to upgrade PHP to 5.5.34, 5.6.20, or 7.0.5+ (or newer) and, for Apple environments, update macOS / OS X to 10.11.5 or newer.

Reachability context: the reported weakness is consistent with attacks requiring a path where an attacker can influence what the Fileinfo logic processes (matching the “context-dependent” nature described).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS92nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

5.4% chance of exploitation activity in the next 30 days, which ranks it in the 92nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

23 events over 3778 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → 0epss band change
2026-09-21EPSS band change0 → moderateepss band change
2026-09-06EPSS band changemoderate → 0epss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

Apple Inc.commercial · USaka apple, apple computer
- mac os xOSOn-premOperating Systems / unix-bsd
- OS XOperating Systems
phposs-project · USaka pear, php language, pecl
- phpDev ToolOSS Libraries / generic-library
PHP Grouposs-projectaka php, pear
- PHPLibraryLibraryOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Scored 7.3 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable