GHSA-x43w-ph7m-pfjx hexchat crate has a Use After Free vulnerability
The hexchat Rust crate contains a use-after-free vulnerability in command deregistration, potentially allowing code execution or crashes; users should migrate to maintained alternatives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-x43w-ph7m-pfjx?
GHSA-x43w-ph7m-pfjx is an use after free vulnerability in hexchat, published on 17 Nov 2025.
Official description
All versions of this crate have function deregister_command which can result in use after free. This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the hexchat crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.
Which versions are affected by GHSA-x43w-ph7m-pfjx?
3 open source packages ship an affected version, including hexchat.
| Package | Affected | Fixed in |
|---|---|---|
hexchat crates.io | All versions to 0.6.3 | None |
hexchat crates.io | All versions to 0.6.3 | None |
hexchat crates.io | From 0.0.0-0 | None |
How do I fix GHSA-x43w-ph7m-pfjx?
No fix has been published for GHSA-x43w-ph7m-pfjx yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-x43w-ph7m-pfjx being exploited?
There is no known exploitation of GHSA-x43w-ph7m-pfjx in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0153.