RUSTSEC-2025-0005

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0005

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0005.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2025-0005

Aliases

GHSA-qm2p-4w45-v2vr

Published

2025-01-13T12:00:00Z

Modified

2025-10-28T06:29:25.945179Z

Summary

Out of bounds write triggered by crafted coverage data

Details

Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut without validating that the index is in bounds.

This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / grcov

Package

Name: grcov; View open source insights on deps.dev
Purl: pkg:cargo/grcov

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.8.21-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "functions": [
            "grcov::covdir::get_coverage"
        ],
        "os": [],
        "arch": []
    }
}