Which products and versions are affected by CVE-2012-2386?

Affected: PHP; php5 (debian); php-bcmath (amazon), among others. The full list is in the CVE brief.

Is CVE-2012-2386 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2012-2386 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2012-2386?

Public exploit code is available.

Is there a fix for CVE-2012-2386?

Fixed versions are available, including PHP 0:5.3.3-14.el6_3, PHP 5.3.14-2.21.amzn1, PHP 5.3.3-14.el6_3.

How urgently should CVE-2012-2386 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2012-2386PHP Heap Buffer Overflow

php: Integer overflow leading to heap-buffer overflow in the Phar extension

Published May 21, 2012 · Updated Mar 9, 2026 · Also known as DEBIAN-CVE-2012-2386, DSA-2492-1

Key Facts

Patch immediately

CVE-2012-2386 is a high-severity vulnerability (CVSS 7.5 v2) affecting PHP, php5 (debian), php-bcmath (amazon) and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 42% probability of exploitation in the next 30 days.
Fixed versions are available, including PHP 0:5.3.3-14.el6_3, PHP 5.3.14-2.21.amzn1, PHP 5.3.3-14.el6_3.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v2

7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS (30-day exploit likelihood)

42%

Higher than 98.6% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

44/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryAPPLE-SA-2012-09-19-2
advisorySUSE-SU-2012:0840
advisory[oss-security] 20120522 Re: CVE request: PHP Phar - arbitrary code execution
advisoryRHSA-2012:1046
advisoryRHSA-2012:1047
advisoryhttps://bugs.php.net/bug.php?id=61065

Description

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

Affected Products

79 affected entries in total

Product	Affected versions	Fixed in
PHPPHP	See advisory	5.3.13
php5debian	See advisory	5.3.3-7+squeeze13
php-bcmathamazon	See advisory	5.3.14-2.21.amzn1
php-cliamazon	See advisory	5.3.14-2.21.amzn1
php-commonamazon	See advisory	5.3.14-2.21.amzn1

20 more affected products in the full CVE brief