RUSTSEC-2025-0028 cve-rs introduces memory vulnerabilities in safe Rust
The cve-rs crate demonstrates memory vulnerabilities in safe Rust by exploiting a compiler soundness bug, potentially allowing code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2025-0028?
RUSTSEC-2025-0028 is a memory corruption vulnerability in cve-rs, published on 10 Feb 2025.
Official description
This crate is a joke and should never be used.
cve-rs provides demonstrations of common memory vulnerabilities (such as buffer overflows and segfaults) implemented completely within safe Rust.
Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc: https://github.com/rust-lang/rust/issues/25860
Which versions are affected by RUSTSEC-2025-0028?
1 open source package ship an affected version, including cve-rs.
| Package | Affected | Fixed in |
|---|---|---|
cve-rs crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2025-0028?
No fix has been published for RUSTSEC-2025-0028 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2025-0028 being exploited?
There is no known exploitation of RUSTSEC-2025-0028 in the wild and no public exploit code.