CVE-2024-58253 obfstr Type Confusion vulnerability
The obfstr crate allows invalid UTF-8 conversion due to unrestricted argument types, potentially causing runtime errors or undefined behavior in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58253?
CVE-2024-58253 is a low-severity vulnerability in CasualX obfstr, published on 2 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an invalid value.
Weakness: CWE-843
Which versions are affected by CVE-2024-58253?
2 open source packages ship an affected version, including obfstr.
| Package | Affected | Fixed in |
|---|---|---|
obfstr crates.io | All versions | 0.4.4 |
obfstr crates.io | All versions | 0.4.4 |
How do I fix CVE-2024-58253?
Upgrade obfstr to 0.4.4 or later.
Is CVE-2024-58253 being exploited?
There is no known exploitation of CVE-2024-58253 in the wild and no public exploit code.
Sources
Also known as GHSA-v2p5-q653-9j99.