The vulnerability resides in async‑tar’s handling of PAX size extensions for intermediary archive entries such as GNU longname, longlink, or PAX x/g headers. When a buffered PAX record is incorrectly applied, the library advances the stream cursor by an attacker‑controlled amount while consuming the intermediary header body. This mis‑synchronizes the parser with the rest of the tar stream, causing it to read subsequent data at wrong boundaries. The result is that an attacker can smuggle arbitrary file entries or manipulate the content seen by downstream code, potentially exposing sensitive data or executing unintended code. The weakness is a classic input validation flaw (CWE‑20) coupled with type confusion in parsing (CWE‑843) and a buffer misuse flaw (CWE‑1286).

The issue affects the Rust library async‑tar produced by dignifiedquire. Versions earlier than 0.6.1 are vulnerable. The vulnerability was fixed in version 0.6.1, as noted in the upstream repository and security advisory. No other third‑party products are mentioned in the CNA data. Users of async‑tar 0.6.0 and earlier that parse untrusted tar archives are impacted.

The CVSS score of 6.3 indicates moderate risk. No EPSS score is available, but the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the desync by crafting a tar file with a malicious PAX size extension preceding an intermediary header. Because the parser incorrectly jumps ahead, it may expose data from subsequent entries or execute application‑specific logic on out‑of‑sync content. The effect depends on how the application consumes the parsed entries; it could lead to directory traversal, data leakage, or code execution if the application trusts the parsed paths or data. Given the moderate CVSS and lack of high exploitation probability data, the risk is elevated for environments that accept untrusted archives. Applying the patch or disabling PAX extensions mitigates the vulnerability entirely.