Insufficient length checks when reading directory entries of a crafted phar archive cause a stack buffer overflow or over-read, which can lead to memory corruption or code execution.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.2 | < 8.2.9 | 8.2.9 |
| PHP 8.1 | < 8.1.22 | 8.1.22 |
| PHP 8.0 | < 8.0.30 | 8.0.30 |
Older branches: not assessed
Exploitation conditions
- Processing an untrusted phar archive
Remediation
Upgrade to 8.0.30, 8.1.22, 8.2.9 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 9.8 v3.1 | NVD | — |
| 9.4 v3.1 | CNA | — |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: The CVE description says "8.2.* before 8.2.8"; the fix shipped in 8.2.9 together with 8.1.22 and 8.0.30.