Vulnerability record · CVE-2016-3078 · published 7 August 2016
CVE-2016-3078: PHP zip extension integer overflow in ZipArchive methods
Php · Php
PHP before 7.0.6 contains multiple integer overflows in php_zip.c in the zip extension. A crafted call to ZipArchive::getFromIndex or getFromName triggers a heap-based buffer overflow, crashing the application and potentially allowing further impact.
Description
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCritical CVSS 9.8 and very high EPSS with public exploit code, though not listed in KEV and the flaw is in a specific extension method.
What it is
PHP before 7.0.6 contains multiple integer overflows in php_zip.c in the zip extension. A crafted call to ZipArchive::getFromIndex or getFromName triggers a heap-based buffer overflow, crashing the application and potentially allowing further impact.
Impact
An attacker can crash the PHP process (denial of service) and, given the heap overflow, possibly achieve code execution or other unspecified impact.
Attack surface
Reached remotely over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any application that passes attacker-influenced input to ZipArchive::getFromIndex or getFromName is exposed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.56132 (99th percentile) and multiple references are tagged Exploit, including Exploit-DB 39742, indicating public exploit code exists.
What to do
- Upgrade PHP to 7.0.6 or later, or apply the vendor patch commit 3b8d4de300854b3517c7acb239b84f7726c1353c.
- If immediate upgrade is not possible, disable or restrict use of the zip extension where it is not needed.
- Validate and sanitize all input passed to ZipArchive::getFromIndex and getFromName, and avoid processing untrusted archives.
- Run PHP with memory limits and process isolation to reduce the impact of a heap overflow.
- Monitor vendor and distribution advisories for backported fixes if running a packaged PHP build.
Detection
- Look for PHP process crashes or segfaults correlated with zip extension usage in application and system logs.
- Monitor for requests that supply archive paths or indices to endpoints invoking ZipArchive::getFromIndex or getFromName.
- Use exploit signatures for Exploit-DB 39742 in network or host IDS where available.
- Track PHP version inventory to identify hosts still running versions before 7.0.6.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-3078 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-3078), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
