Is CVE-2014-5386 being actively exploited?

CVE-2014-5386 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2014-5386?

CVE-2014-5386 has a CVSS 2.0 base score of 5.0 (MEDIUM).

CVE-2014-5386

MEDIUM · CVSS 5.0EPSS 1.5%EU EUVD

The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector.

Key facts

CVSS score: 5.0 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness (CWE): CWE-310
EPSS score: 1.5% (75th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2014-5274)
Published: December 28, 2014
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2014-5274 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

facebook / hiphop virtual machine

References

https://github.com/facebook/hhvm/commit/ab6fdeb84fb090b48606b6f7933028cfe7bf3a5e

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain