The vulnerability exists in the _read_tar() function of Archive::Tar before version 3.10, where the size field from the 12-byte tar header entry is used to determine the amount of memory to allocate for reading the entry's payload. Because there is no upper bound check on this size value, an attacker can craft a tar header declaring an excessively large size, causing Perl to allocate a very large scalar. This leads to memory exhaustion and potential denial of service. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can cause memory exhaustion on systems processing malicious tar archives using vulnerable versions of Archive::Tar. This can lead to denial of service conditions due to excessive memory allocation. There is no indication of confidentiality or availability impact, but integrity impact is rated high per CVSS. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from BINGOS or the Archive::Tar maintainers. Until a fix is available, avoid processing untrusted tar archives with vulnerable versions of Archive::Tar to mitigate risk.