CVE-2023-3824
Buffer overflow and overread in phar_dir_read()
CRITICAL 9.8EPSS 21.8%
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
- Affected
- PHP Group · PHP
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 PHP
- 9.4 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - EPSS
- 21.79% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2023-08-11
- Updated
- 2025-02-13
Proof-of-concept exploits (4)
- php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv
- dadosneurais/cve-2023-38240★ · 2025-09-23
- jhonnybonny/CVE-2023-38243★ · 2024-03-18
- tk-1001/PHPexploit_pack0★ · 2025-06-04