CVE-2023-3824 CRITICAL

CVE-2023-3824: Buffer overflow and overread in phar_dir_read()

Vendor Php Group
Product PHP
Weakness CWE-119
Published August 11, 2023
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

Key dates

02Disclosure timeline

August 11, 2023 CVE published
February 13, 2025 Record updated