GHSA-5w5r-mf82-595p Unsound APIs of public `constant::Reader` and `StructSchema`

Not scored Published 24 Dec 2025

Unsound APIs in the Rust library allow safe code to trigger undefined behavior, potentially leading to crashes or arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Not stated
Victim action needed: Not needed
Fix: Available

What is GHSA-5w5r-mf82-595p?

GHSA-5w5r-mf82-595p is a memory corruption vulnerability in capnp, published on 24 Dec 2025.

Official description

The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::get_root_unchecked, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.

`Reader::get`

pub fn get(&amp;self) -&gt; Result&lt;&lt;T as Owned&gt;::Reader&lt;&#39;static&gt;&gt; {
    // ...
    // UNSAFE: access `words` without validation
}

`StructSchema::new`

pub fn new(builder: RawBrandedStructSchema) -&gt; StructSchema {
    // ...
    // UNSAFE: access encoded nodes without validation
}

This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.

The issue is resolved in version 0.24.0 by making constructor functions unsafe and mark the fields of struct as visible only in the crate.

Which versions are affected by GHSA-5w5r-mf82-595p?

3 open source packages ship an affected version, including capnp.

Package	Affected	Fixed in
`capnp` crates.io	All versions	`0.24.0`
`capnp` crates.io	All versions	`0.24.0`
`capnp` crates.io	From `0.0.0-0`	`0.24.0`

How do I fix GHSA-5w5r-mf82-595p?

Upgrade capnp to 0.24.0 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is GHSA-5w5r-mf82-595p being exploited?

There is no known exploitation of GHSA-5w5r-mf82-595p in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2025-0143.