Circular symbolic links in PHP archive files can cause an unbounded recursion that exhausts the C stack and crashes the PHP process. The flaw is rooted in the handling of PHAR archives and results in a denial‑of‑service condition that can be triggered when a malicious PHAR file is processed. The vulnerability is classified as CWE‑121, a stack buffer overflow weakness, and also involves improper validation of symbolic links (CWE‑606).

The vulnerability affects PHP versions 8.2.*, 8.3.*, 8.4.*, and 8.5.* that are prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9 respectively. This includes all distributions and builds of PHP that ship these versions.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is not explicitly detailed in the advisory; it is inferred that the flaw can be exploited when PHP processes a malicious PHAR archive, which may be delivered locally or remotely depending on application usage. Because the weaknesses involve a stack buffer overflow (CWE‑121) and improper validation of symbolic links (CWE‑606) that lead only to a crash rather than arbitrary code execution, the risk is limited to denial‑of‑service under the described conditions.