CVE-2025-64118

A flaw was found in node-tar, a Tar utility for Node.js. This vulnerability allows a local attacker to potentially disclose sensitive information. When the .t (or .list) function is used with { sync: true } to read tar entry contents, and the tar file is concurrently modified on disk to a smaller size, the function may return uninitialized memory contents. This could lead to the exposure of arbitrary data.

This vulnerability is rated Moderate for Red Hat products because it affects node-tar when synchronously reading tar entry contents from a file that is concurrently modified to a smaller size. This race condition can lead to the exposure of uninitialized memory. Exploitation requires an attacker to control the tar file and time its modification during a synchronous read operation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.