GHSA-gg76-hg3v-5q6c macroquad vulnerable to multiple soundness issues
Unprincipled use of mutable statics in macroquad allows attackers to trigger use-after-free vulnerabilities in safe code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-gg76-hg3v-5q6c?
GHSA-gg76-hg3v-5q6c is an use after free vulnerability in macroquad, published on 23 Apr 2025.
Official description
Several soundness issues have been reported. Resolving them doesn't seem to be considered a priority. In particular, unprincipled use of mutable statics is pervasive throughout the library, making it possible to cause use-after-free in safe code.
Currently, no fixed version is available.
Which versions are affected by GHSA-gg76-hg3v-5q6c?
3 open source packages ship an affected version, including macroquad.
| Package | Affected | Fixed in |
|---|---|---|
macroquad crates.io | All versions to 0.4.14 | None |
macroquad crates.io | All versions to 0.4.14 | None |
macroquad crates.io | From 0.0.0-0 | None |
How do I fix GHSA-gg76-hg3v-5q6c?
No fix has been published for GHSA-gg76-hg3v-5q6c yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-gg76-hg3v-5q6c being exploited?
There is no known exploitation of GHSA-gg76-hg3v-5q6c in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0035.