TARmageddon flaw in abandoned Rust library enables RCE attacks

A high-severity vulnerability in the now-abandoned async-tar Rust library and its forks can be exploited to gain remote code execution on systems running unpatched software. Tracked as CVE-2025-62518, this logic flaw results from a desynchronization issue that allows unauthenticated attackers to inject additional archive entries during TAR file extraction. This occurs specifically when processing nested TAR files with mismatched ustar and PAX extended headers, causing the parser to jump into the file content and mistake it for tar headers, leading to the extraction of attacker-supplied files. Edera, the cybersecurity company that discovered the vulnerability and dubbed it TARmageddon, explains that threat actors can exploit it to overwrite files in supply chain attacks by replacing configuration files and hijacking build backends. This security flaw affects not only projects using async-tar but also tokio-tar, an extremely popular fork with over 7 million downloads on crates.io that has also been abandoned. While the active forks have already been patched, Edera says it's not possible to accurately estimate the impact of this vulnerability due to the widespread nature of its forks, including tokio-tar. "Due to the widespread nature of tokio-tar in various forms, it is not possible to truly quantify upfront the blast radius of this bug across the ecosystem," said Edera. "While the active forks have been successfully patched (see also Astral Security Advisory), this disclosure...