PT-2025-42899 · Unknown+1 · Astral-Tokio-Tar+1

Published 2025-10-21 · Updated 2026-05-06 · CVE-2025-62518

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions prior to 0.5.6 async-tar versions prior to 0.5.6 tokio-tar versions prior to 0.5.6

Description astral-tokio-tar, async-tar, and tokio-tar are vulnerable to a boundary parsing issue due to inconsistent handling of PAX/ustar headers. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances the stream position based on the ustar header size (often zero) instead of the PAX-specified size, leading to misinterpretation of file content as legitimate tar headers. This can allow attackers to smuggle additional archive entries. The vulnerability is exploitable when processing untrusted tar archives and may result in arbitrary code execution or credential exfiltration. The issue stems from the parser using the ustar size instead of the PAX override when calculating the file position. This vulnerability is also known as TARmageddon (CVE-2025-62518).

Recommendations Upgrade astral-tokio-tar to version 0.5.6 or newer. Upgrade async-tar to version 0.5.6 or newer. Upgrade tokio-tar to version 0.5.6 or newer.

Exploit

Fix

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2025-15219

CVE-2025-62518

GHSA-GCHP-Q4R4-X4FF

GHSA-J5GW-2VRG-8FGX

GHSA-W476-P2H3-79G9

OPENSUSE-SU-2025:15658-1

OPENSUSE-SU-2026:20026-1

RUSTSEC-2025-0110

RUSTSEC-2025-0111

SUSE-SU-2026:20077-1

Affected Products

Debian

Astral-Tokio-Tar

References · 102

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62518.json · Exploit
• 🔥 https://github.com/edera-dev/cve-tarmageddon · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15658-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5gw-2vrg-8fgx · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62518 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-62518 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15219 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62518 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20077-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20026-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w476-p2h3-79g9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62518 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-62518 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62518 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gchp-q4r4-x4ff · Vendor Advisory