An integer overflow or wraparound vulnerability exists in the TarUtils module of MuntashirAkon AppManager, specifically in org.apache.commons.compress.archivers.tar. The flaw arises when processing TAR archive files and can cause incorrect calculation of buffer sizes. This leads to potential memory corruption, application crashes, or denial of service. The weakness is classified as CWE-190, representing integer overflows.

The vulnerability affects AppManager versions before 4.0.4. It involves the TarUtils.java file within the application's tar handling modules. Users running older releases of the application are at risk if they process untrusted TAR archives.

The CVSS score of 4.6 indicates a low to moderate severity, while the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further reducing immediate threat. Exploitation would likely require an attacker to supply a malicious TAR file to the application, which suggests a local or user‑supplied vector. Given the current metrics, the immediate risk is low, but securing the application through updates or mitigations is prudent.