The vulnerability CVE-2026-32766 affects the astral-tokio-tar library, a Rust-based asynchronous tar archive reading and writing tool. In versions 0.5.6 and earlier, the library silently skips malformed PAX extensions during tar archive parsing instead of rejecting or erroring on them. PAX extensions are metadata fields in tar archives that can include file attributes. This silent skipping can be exploited to create a parser differential attack scenario, where one parser (astral-tokio-tar) ignores malformed extensions, but another parser incorrectly interprets them. Such a discrepancy can be leveraged to cause inconsistent parsing outcomes, potentially leading to security issues like path traversal, file overwrite, or privilege escalation if the secondary parser is vulnerable. However, exploitation requires a secondary vulnerability in another tar parser that does not properly validate malformed PAX extensions. This dependency on a separate parser vulnerability significantly reduces the likelihood and impact of exploitation. The issue is classified under CWE-436 (Interpretation Conflict) and has a CVSS 4.0 base score of 1.7, reflecting low severity. The vulnerability was publicly disclosed in March 2026 and fixed in astral-tokio-tar version 0.6.0.

The direct impact of this vulnerability is limited due to the requirement of a secondary vulnerability in another tar parser for successful exploitation. If exploited, it could lead to inconsistent interpretation of tar archive contents, potentially enabling attacks such as unauthorized file extraction, overwriting critical files, or bypassing security controls that rely on tar archive integrity. This could affect software supply chains, backup systems, or container image processing that utilize astral-tokio-tar alongside other tar parsers. However, the low CVSS score and lack of known exploits indicate minimal immediate risk. Organizations using astral-tokio-tar in isolated environments without interacting with other tar parsers are unlikely to be affected. The threat is primarily relevant in complex environments where multiple tar parsers with differing validation behaviors coexist.

The primary mitigation is to upgrade astral-tokio-tar to version 0.6.0 or later, where the issue is fixed by proper handling of malformed PAX extensions. Additionally, organizations should audit their software stacks to identify any other tar parsers in use and ensure they correctly validate PAX extensions to prevent parser differential attacks. Implementing strict input validation and integrity checks on tar archives before processing can reduce risk. For environments processing untrusted tar files, consider sandboxing or isolating archive extraction processes to limit potential damage. Monitoring for unusual file system changes or unexpected archive extraction behaviors can help detect exploitation attempts. Finally, maintain awareness of updates and patches for all tar processing libraries in use to address similar vulnerabilities promptly.