CVE-2023-3824
CriticalCVSS 9.4Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar files, insufficient length checking may lead to a stack buffer overflow, potentially resulting in memory corruption or RCE.
Risk Assessment
Organizations may face serious threats such as data corruption or remote code execution, which could lead to loss of control over the system.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and conduct an audit of applications using PHP to identify potential threats.
Original NVD description (English source)
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.