CVE-2023-3824: Debian Linux

Critical severity, CVSS 9.8. EPSS: 21.8% chance of exploitation in the next 30 days.

In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 38 only
• PHP PHP: from 8.0.0, before 8.0.30 (fixed in 8.0.30); from 8.1.0, before 8.1.22 (fixed in 8.1.22); from 8.2.0, before 8.2.9 (fixed in 8.2.9)

Published 2023-08-11. Last modified 2026-06-17.