CVE-2016-10159: Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x befo...

Security readout for executives and security teams

This flaw affects older PHP versions when handling PHAR archive metadata. A specially malformed PHAR archive can trigger excessive memory use or crash the application. The main business risk is service disruption in legacy PHP systems that accept or process PHAR files from untrusted sources. Exposure is most likely in legacy PHP 5.6 or 7.0 deployments that parse PHAR archives, especially where user-supplied archives can reach PHP's PHAR handling. Current PHP branches are not identified as affected in the provided sources. Treat this as a legacy runtime reliability risk. It should be remediated promptly where old PHP processes untrusted archive content, but the provided evidence does not support emergency treatment for environments already on fixed or supported PHP versions. Mitigation focus: Upgrade PHP to 5.6.30, 7.0.15, or a supported later release.; Apply distribution vendor security updates for packaged PHP.; Restrict untrusted PHAR archive upload or processing where feasible..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.