Back to Database
Status published
Critical
CVE-2023-3824
Buffer overflow and overread in phar_dir_read()
Vulnerability Description
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-3824
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Niels Dossche
References
- https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://security.netapp.com/advisory/ntap-20230825-0001/
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
More from PHP Group
View All →CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Medium
5.9
CVE-2025-1861
Stream HTTP wrapper truncates redirect location to 1024 bytes
Medium
6.3
CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Medium
6.3
CVE-2025-1735
pgsql extension does not check for errors during escaping
Medium
5.9
CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
Medium
6.3
Affected Vendor
PHP Group
View all reports →Affected Software
PHP
Vulnerable Versions:
8.0.*, 8.1.*, 8.2.*
Timeline
Official Publish:
August 11th, 2023
Last Modified:
February 13th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L