RUSTSEC-2025-0167

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0167

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0167.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2025-0167

Published

2025-12-25T12:00:00Z

Modified

2026-08-10T19:45:04.530683607Z

Summary

`Bitmap::try_from(&[u8])` can create invalid values

Details

The TryFrom<&[u8]> implementation for Bitmap<SIZE> copies the input bytes into an uninitialized backing store and calls assume_init() without validating that the bytes form a valid value of the backing store type. For SIZE = 1 the backing store is a bool, so any input byte other than 0x00 or 0x01 produces an invalid value, which is immediate undefined behavior.

The AsMut<[u8]> implementation has the same problem, as it allows safe code to write invalid bit patterns into the backing store through the returned slice.

No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / bitmaps

Package

Name: bitmaps; View open source insights on deps.dev
Purl: pkg:cargo/bitmaps

Affected ranges

Type: SEMVER
Events: Introduced

3.2.0

Ecosystem specific

{
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    },
    "affected_functions": null
}

Database specific

cvss

null