CVE-2026-6103

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6103
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6103.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6103
Aliases
Downstream
ALPINE (1)
ALSA (1)
AZL (1)
BELL (1)
CLEANSTART (1)
CLSA (3)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (8)
OESA (4)
openSUSE (2)
RHSA (1)
RLSA (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (5)
Published
2026-09-25T20:08:49Z
Modified
2026-10-28T02:30:28Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Details

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6103.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.2.*"
                        },
                        {
                            "fixed": "8.2.34"
                        },
                        {
                            "introduced": "8.3.*"
                        },
                        {
                            "fixed": "8.3.35"
                        },
                        {
                            "introduced": "8.4.*"
                        },
                        {
                            "fixed": "8.4.26"
                        },
                        {
                            "introduced": "8.5.*"
                        },
                        {
                            "fixed": "8.5.11"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
4f06e773c8c7e4b8430cfcf378fcd318a57f3742
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "0x1FFFFFFFF"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

Other
RELEASE_0_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6103.json"