GHSA-h5j3-crg5-8jqm orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
An integer underflow in index_of_ptr causes undefined behavior with empty slices, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-h5j3-crg5-8jqm?
GHSA-h5j3-crg5-8jqm is a vulnerability in orx-pinned-vec, published on 21 Oct 2025.
Official description
The safe function index_of_ptr causes undefined behavior when called with an empty slice.
The issue occurs in the line ptr.add(slice.len() - 1) which underflows when slice.len() is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.
Which versions are affected by GHSA-h5j3-crg5-8jqm?
3 open source packages ship an affected version, including orx-pinned-vec.
| Package | Affected | Fixed in |
|---|---|---|
orx-pinned-vec crates.io | All versions | 3.21.0 |
orx-pinned-vec crates.io | All versions | 3.21.0 |
orx-pinned-vec crates.io | From 0.0.0-0 | 3.21.0 |
How do I fix GHSA-h5j3-crg5-8jqm?
Upgrade orx-pinned-vec to 3.21.0 or later.
Is GHSA-h5j3-crg5-8jqm being exploited?
There is no known exploitation of GHSA-h5j3-crg5-8jqm in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0106.