CVE-2026-6103
published 2026-09-25CVE-2026-6103: phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to…
PriorityP413low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.16%
5.1th percentile
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php | php | >= 8.2.0 < 8.2.34 | 8.2.34 |
| php | php | >= 8.3.0 < 8.3.35 | 8.3.35 |
| php | php | >= 8.4.0 < 8.4.26 | 8.4.26 |
| php | php | >= 8.5.0 < 8.5.11 | 8.5.11 |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_8.4 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.34 | 8.2.34 |
| php_group | php | >= 8.3.* < 8.3.35 | 8.3.35 |
| php_group | php | >= 8.4.* < 8.4.26 | 8.4.26 |
| php_group | php | >= 8.5.* < 8.5.11 | 8.5.11 |
| ubuntu | php5 | — | — |
| ubuntu | php7.0 | — | — |
| ubuntu | php7.2 | — | — |
| ubuntu | php7.4 | — | — |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_redhat4.3MEDIUM
vendor_ubuntu3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 3.4
CVE-2026-93682 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP did not properly validate the size of MySQL
server packets in the mysqlnd driver. A malicious server could possibly use
this issue to cause PHP to crash, resulting in a denial of service. This
issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)
It was discovered that PHP incorrectly handled response buffer sizes in the
SOAP HTTP client. A malicious server could possibly use this issue to cause
PHP to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2025-14181)
It was discovered that PHP incorrectly handled certain TAR archive headers
in the Phar extension. An attacker could pos
Red Hat
php: PHP: Archive entry injection via integer overflow in TAR parser
vendor_redhat·2026-09-25·CVSS 4.3
CVE-2026-6103 [MEDIUM] CWE-190 php: PHP: Archive entry injection via integer overflow in TAR parser
php: PHP: Archive entry injection via integer overflow in TAR parser
A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causing the parser to miscalculate data boundaries and treat file content as valid header data. This allows an attacker to inject unauthorized entries that the application extracts as authentic files, potentially leading to unauthorized data modification.
Package: php (Red Hat Enterprise Linux 10) - Fix deferred
Package: php8.4 (Red Hat Enterprise Linux 10) - Fix deferred
Package: php (Red Hat Enterprise Linux 6) - Out of support sc
VulDB
PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 Tar Header Parser phar_tar_number integer overflow
vuldb·2026-09-25·CVSS 4.3
CVE-2026-6103 [MEDIUM] PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 Tar Header Parser phar_tar_number integer overflow
A vulnerability was found in PHP up to 8.2.33/8.3.34/8.4.25/8.5.10. It has been rated as problematic. Impacted is the function phar_tar_number of the component Tar Header Parser. The manipulation leads to integer overflow.
This vulnerability is traded as CVE-2026-6103. An attack has to be approached locally. There is no exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-6103 php: PHP: Archive entry injection via integer overflow in TAR parser [fedora-all]
bugzilla·2026-10-14·CVSS 4.3
CVE-2026-6103 [MEDIUM] CVE-2026-6103 php: PHP: Archive entry injection via integer overflow in TAR parser [fedora-all]
CVE-2026-6103 php: PHP: Archive entry injection via integer overflow in TAR parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
Bugzilla
CVE-2026-6103 php: PHP: Archive entry injection via integer overflow in TAR parser
bugzilla·2026-09-25·CVSS 4.3
CVE-2026-6103 [MEDIUM] CVE-2026-6103 php: PHP: Archive entry injection via integer overflow in TAR parser
CVE-2026-6103 php: PHP: Archive entry injection via integer overflow in TAR parser
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
2026-09-25
Published