Tar Rs EUVD-2026-13596

The victim must open/extract a crafted tar archive using tar-rs library version 0.4.44 or below in a Rust application. Attacker crafts archive with conflicting PAX and base header sizes to cause inconsistent file size interpretation across different tar parsers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L) indicates a network-accessible vulnerability with low attack complexity requiring user interaction, resulting in limited confidentiality and integrity impact. The 5.1 base score is moderate but somewhat misleading given the practical constraints: exploitation requires crafting a malicious tar archive and convincing a user or automated system to process it with tar-rs while simultaneously processing the same archive with a standards-compliant parser to observe the discrepancy. The real-world risk is moderate to low for most use cases, as the vulnerability primarily affects supply chain and archive comparison scenarios rather than direct system compromise. No KEV (Known Exploited Vulnerability) status is indicated, suggesting no widespread in-the-wild exploitation. However, the vulnerability is particularly concerning for package managers, build systems, and security scanning tools that rely on tar-rs for archive integrity verification, as attackers could exploit the parsing divergence to hide malicious files from tar-rs-based analysis. The moderate CVSS score combined with the requirement for user interaction (UI:A) and limited impact suggests this should be prioritized after critical vulnerabilities but addressed promptly in affected supply chain tooling.

An attacker crafts a tar archive containing a file entry with a nonzero size in the traditional tar header (e.g., 1000 bytes) but a different size in the PAX extended header (e.g., 5000 bytes). When a tar-rs-based security scanner processes this archive, it extracts the file as 1000 bytes, potentially missing embedded malicious content in the additional 4000 bytes that a standards-compliant parser would extract. Alternatively, the attacker could hide a malicious file by specifying zero size in the PAX header while the base header contains a nonzero value, causing tar-rs to extract fewer bytes than expected while other parsers extract the full malicious content, creating a supply chain attack where different systems see different file contents. No public proof-of-concept is currently referenced, but the attack requires only basic tar format knowledge and can be automated.