TARmageddon Flaw in Popular Rust Library Leads to RCE

A high-severity vulnerability in the popular Rust library Async-tar could allow attackers to smuggle archive entries and execute arbitrary code remotely, tracked as CVE-2025-62518 with a CVSS score of 8.1, and dubbed TARmageddon. The flaw is a desynchronization issue that occurs during the processing of nested TAR files when there is a mismatch between PAX and ustar headers, allowing the parser to misinterpret the inner archive’s headers as belonging to the outer archive.

According to Edera, the impact across the ecosystem cannot be quantified because the vulnerable library, Async-tar, and its most popular fork, Tokio-tar, have been abandoned, which also prevented a patch from upstream. Tokio-tar has over 5 million downloads on crates[.]io and is used in downstream projects such as Krata-tokio-tar, Astral-tokio-tar, and others, with Astral-tokio-tar (version 0.5.6) and Krata-tokio-tar updated to fix the bug.

Edera notes that downstream users were advised to switch to patched libraries or to modify TAR parsers to prioritise PAX headers for size determination and to add strict boundary checking. The flaw could enable remote code execution and may be exploited in supply chain attacks to hijack build backends, the security firm says.