risk example — malware could be inserted into a file such that the tampered file produces the same digest as the original, defeating integrity checks meant to detect tampering
MD5 is known to be capable of generating collisions (known since roughly the mid-1990s), which is why more cryptographically secure algorithms like SHA-256 are preferred wherever security matters
When two different inputs produce the same hash digest; it breaks integrity verification (a tampered file could match the original's digest) and marks the algorithm as broken