RUSTSEC-2026-0191

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0191

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0191.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0191

Published

2026-05-28T12:00:00Z

Modified

2026-06-29T14:45:04Z

Summary

`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic

Details

Affected versions of solana_rbpf expose the safe method EbpfVm::invoke_function. This method computes an obfuscated VM pointer by casting self to *mut u64 and applying a randomized offset derived from get_runtime_environment_key().

The resulting pointer arithmetic is performed with ptr::offset, which requires the computed pointer to remain within the same allocation. In practice, the randomized offset can move the pointer far outside the allocation containing the EbpfVm, causing undefined behavior before the supplied builtin function is invoked.

Unmaintained

The upstream solana_rbpf repository is archived, and no patched version of this crate is currently available.

Users should migrate to the maintained solana-sbpf crate. The issue has been fixed there in anza-xyz/sbpf#151.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / solana_rbpf

Package

Name: solana_rbpf; View open source insights on deps.dev
Purl: pkg:cargo/solana_rbpf

Affected ranges

Type: SEMVER
Events: Introduced

0.8.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "solana_rbpf::vm::EbpfVm::invoke_function"
        ],
        "os": []
    }
}