GitHub Advisoryadvisory · crates.io

GHSA-wwxp-hxh6-8gf8 binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

HIGH Published 2025-10-22 Modified 2025-10-22 Official page ↗
Ecosystem
crates.io
Packages
binary_vec_io
Severity
High
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-120
Reviewed
2025-10-22

Affected packages

• crates.io binary_vec_io: <= 0.1.12 (no fix yet)

Description

Safe functions accept a single `&T` or `&mut T` but multiply by `n` to create slices extending beyond allocated memory when `n > 1`. These functions use `from_raw_parts` to create slices larger than the underlying allocation, violating memory safety. The binary_vec_io repository is archived and unmaintained.

Related

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References