CVE-2016-10159 in macOS
Summary
by MITRE
Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/14/2026
The vulnerability identified as CVE-2016-10159 represents a critical integer overflow flaw within PHP's PHAR (PHP Archive) extension that affects versions prior to 5.6.30 and 7.0.15. This vulnerability resides in the phar_parse_pharfile function located in ext/phar/phar.c, which processes PHAR archive files and handles manifest entries. The integer overflow occurs when parsing truncated manifest entries within PHAR archives, creating a scenario where maliciously crafted archive files can trigger unexpected behavior in the PHP runtime environment. The vulnerability is particularly concerning because it can be exploited remotely, allowing attackers to cause denial of service conditions that impact system availability and application stability.
The technical implementation of this vulnerability stems from improper handling of integer values during the parsing of PHAR archive manifests. When a PHAR archive contains a truncated manifest entry, the phar_parse_pharfile function fails to properly validate the size parameters, leading to integer overflow conditions. This overflow can result in memory allocation errors or buffer overflows that cause the PHP application to crash or consume excessive memory resources. The vulnerability specifically targets the way PHP handles size calculations for manifest entries, where an attacker can craft a PHAR file with maliciously sized values that, when processed by the vulnerable function, trigger the overflow condition. This type of vulnerability falls under CWE-190, which describes integer overflow conditions, and aligns with ATT&CK technique T1499.004 for resource exhaustion attacks.
The operational impact of CVE-2016-10159 extends beyond simple application crashes to encompass significant system availability concerns. Remote attackers can leverage this vulnerability to consume excessive memory resources or cause application crashes, effectively creating denial of service conditions that can impact web applications relying on PHP processing. Systems that process untrusted PHAR archives, such as those handling file uploads or third-party library installations, become particularly vulnerable to exploitation. The vulnerability is especially dangerous in environments where PHP applications process user-uploaded files or external PHAR archives, as these scenarios provide direct attack vectors. Additionally, the memory consumption aspect of this vulnerability can lead to system instability, potentially causing cascading failures in server environments where multiple PHP processes are running simultaneously. The impact is amplified when considering that PHAR archives are commonly used for packaging and distribution of PHP applications and libraries, making the attack surface broader than initially apparent.
Mitigation strategies for CVE-2016-10159 primarily focus on immediate version upgrades to patched PHP releases, specifically PHP 5.6.30 and PHP 7.0.15 or later versions. Organizations should prioritize updating their PHP installations to eliminate the integer overflow vulnerability at its source. Additionally, implementing strict input validation for PHAR archive processing can provide defensive measures, including validating file sizes and manifest entries before processing. Security configurations should include disabling PHAR processing for untrusted inputs and implementing proper file type validation to prevent the execution of potentially malicious PHAR archives. Network-level protections can involve implementing web application firewalls that monitor for suspicious PHAR archive patterns and blocking requests that contain malformed manifest entries. Organizations should also consider implementing monitoring and logging mechanisms to detect unusual memory consumption patterns or application crashes that could indicate exploitation attempts. Regular security assessments and vulnerability scanning should include checks for outdated PHP versions to prevent exploitation of this and similar integer overflow vulnerabilities that may exist in older PHP installations.