CVE-2026-92612 Memory corruption in Eclipse iceoryx™
Attackers can trigger undefined behavior and potential crashes or code execution by creating invalid string slices via unsafe mutable byte access in the iceoryx2 library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-92612?
CVE-2026-92612 is a low-severity memory corruption vulnerability in Eclipse iceoryx™, published on 21 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.
Weakness: CWE-749
Which versions are affected by CVE-2026-92612?
1 open source package ship an affected version, including iceoryx2-bb-container.
| Package | Affected | Fixed in |
|---|---|---|
iceoryx2-bb-container crates.io | From 0.0.0-0 | 0.10.0 |
How do I fix CVE-2026-92612?
Upgrade iceoryx2-bb-container to 0.10.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-92612 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92612 exists.
Sources
Also known as GHSA-8mq4-3mwq-qvg6, GHSA-gm83-3hcx-j6jj, RUSTSEC-2026-0294.