The vulnerability lies in the phar_tar_number() function, which converts an 11‑digit octal size field from a TAR header into an unsigned 32‑bit value without checking for overflow. Because the field can represent values up to 0x1FFFFFFFF, a payload that exceeds 0xFFFFFFFF silently wraps around to a smaller size. This causes the parser to skip an incorrect amount of data and subsequently misinterpret attacker‑controlled content as the next TAR header, allowing an attacker to inject entries that the PharData library will report and extract as legitimate files.

PHP installations that rely on the Phar extension to process TAR archives are impacted. No specific version range is provided, so all versions using the deprecated phar_tar_number() routine are potentially affected. Users should verify their PHP version and confirm whether the vulnerability exists in their current release.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploit activity yet. The likely attack vector is delivery of a malicious PHAR/TAR file to an application that processes user‑supplied archives, which can be done locally or over a network if the application accepts remote uploads. An attacker who successfully exploits the overflow can force the deployment pipeline or file extraction logic to admit files that appear legitimate, potentially compromising data integrity or enabling subsequent exploits.