Buffer overflow and overread in phar_dir_read()
PHP Group · PHP
A buffer overflow and overread in the phar_dir_read() function of PHP (the PHP Group's scripting language) stems from insufficient length checking while reading PHAR directory entries when a phar file is loaded. An attacker who can get a crafted phar file loaded by affected PHP versions (8.0 before 8.0.30, 8.1 before 8.1.22, and 8.2 before 8.2.8) could trigger a stack buffer overflow, potentially causing memory corruption or remote code execution, with no privileges, authentication, or user interaction required and network access as the attack vector.
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 9 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 7 months after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+7 mo
- First seen exploitedVulnCheck KEV evidence+9 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 5 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Intel is bad awy27 Feb 2025
- Getting a taste of your own medicine: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials | Datadog Security Labs16 Dec 2024
- ACTUALIZACION | PHP vulnerabilities | Ubuntu security notices | Ubuntu27 Feb 2024
- ACTUALIZACION | Oracle Critical Patch Update Advisory - January 20245 Feb 2024
- ACTUALIZACION | Oracle Critical Patch Update Advisory - October 202320 Oct 2023