CVE-2026-6103 in PHP
Summary
by MITRE • 09/25/2026
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the phar_tar_number function represents a critical integer overflow issue within the PHP Archive (Phar) extension's TAR parsing logic. Specifically, the function is responsible for converting an octal string from a TAR header into a uint32_t variable to determine the size of the subsequent file data block. The technical flaw lies in the absence of bounds checking during this conversion process. Since the field allows values up to 0x1FFFFFFFF but the destination type is limited to a maximum value of 0xFFFFFFFF, any input exceeding this limit results in silent truncation or wrapping. This behavior violates fundamental principles of secure coding regarding integer handling and leads directly to CWE-190 Integer Overflow or Wraparound.
The operational impact of this flaw is severe because it allows an attacker to manipulate the internal state of the Phar parser through a crafted archive file. By supplying a size field that exceeds 32-bit limits, the resulting truncated value causes the parser to skip fewer data blocks than actually exist in the malicious payload. Consequently, the parser misaligns its reading position and interprets subsequent bytes of attacker-controlled content as valid TAR headers rather than raw file data. This desynchronization enables an injection attack where fake entries are embedded within what should be a single large file segment.
This mechanism facilitates CWE-20 Improper Input Validation and potentially CWE-78 OS Command Injection if the injected filenames or contents trigger downstream processing vulnerabilities in applications that rely on Phar archives for configuration loading, autoloading, or data extraction. The attacker can effectively inject arbitrary entries into the archive structure without detection by standard validation routines, as these entries appear legitimate to the parser due to the misaligned header interpretation. This undermines the integrity guarantees provided by PHAR files and allows for potential remote code execution if the application processes the injected paths or contents in a dangerous context.
Mitigation strategies must focus on enforcing strict input validation at the parsing layer. Developers should implement explicit checks to ensure that parsed integer values do not exceed the maximum capacity of their designated data types before proceeding with memory allocation or stream positioning logic. Additionally, applying principle of least privilege by restricting Phar file usage to trusted sources and validating archive structures against known good schemas can reduce exposure. Updating to patched versions of PHP where this overflow check has been implemented is the primary remediation path for end users.