CVE-2026-6103

LowCVSS 3.3/10Last modified Oct 23, 2026

Description

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
PHP GroupPHP>= 8.2.*, < 8.2.34; >= 8.3.*, < 8.3.35; >= 8.4.*, < 8.4.26; >= 8.5.*, < 8.5.11

References

Timeline

Published
Sep 25, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-610308.1Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). CVE-2026-610318.1Vulnerability in the Oracle Financials Common Country product of Oracle E-Business Suite (component: Internal Operations). Supported versioCVE-2026-610328.8Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are aCVE-2026-610338.6Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are aCVE-2026-610349.1Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are aCVE-2026-610357.2Vulnerability in the Oracle Financials for the Americas product of Oracle E-Business Suite (component: Internal Operations). Supported versCVE-2026-610363.8Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affecCVE-2026-610378.1Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affectedCVE-2026-610388.2Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are aCVE-2026-610397.2Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle E-Business Suite (component: Core). Supported versions that arCVE-2026-61049.1In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_enCVE-2026-610408.8Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are a