GHSA-wwxp-hxh6-8gf8 binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref
Safe functions in the archived binary_vec_io library allow out-of-bounds memory access, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-wwxp-hxh6-8gf8?
GHSA-wwxp-hxh6-8gf8 is a memory corruption vulnerability in binary_vec_io, published on 21 Oct 2025.
Official description
Safe functions accept a single &T or &mut T but multiply by n to create slices extending beyond allocated memory when n > 1.
These functions use from_raw_parts to create slices larger than the underlying allocation, violating memory safety.
The binary_vec_io repository is archived and unmaintained.
Which versions are affected by GHSA-wwxp-hxh6-8gf8?
3 open source packages ship an affected version, including binary_vec_io.
| Package | Affected | Fixed in |
|---|---|---|
binary_vec_io crates.io | All versions to 0.1.12 | None |
binary_vec_io crates.io | All versions to 0.1.12 | None |
binary_vec_io crates.io | From 0.0.0-0 | None |
How do I fix GHSA-wwxp-hxh6-8gf8?
No fix has been published for GHSA-wwxp-hxh6-8gf8 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-wwxp-hxh6-8gf8 being exploited?
There is no known exploitation of GHSA-wwxp-hxh6-8gf8 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0109.