RUSTSEC-2025-0164 `DTriangle` accessors may read out of bounds in affected versions
Safe Rust code can trigger undefined behavior via out-of-bounds reads in DTriangle accessors, requiring an upgrade to the fixed version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2025-0164?
RUSTSEC-2025-0164 is a memory corruption vulnerability in i_triangle, published on 24 Apr 2025.
Official description
In affected versions, DTriangle::neighbor_by_order and DTriangle::vertex_by_order were public safe functions that accepted an
arbitrary order value. These functions used order to access fixed-size internal arrays with get_unchecked, without checking whether order was within bounds. Calling these methods with an out-of-bounds order could cause an out-of-bounds read from safe Rust code. This made the old APIs unsound, since safe callers could trigger undefined behavior without using unsafe.
The issue was fixed in version 0.29.0 as part of a broader rewrite that replaced the old triangle implementation with IntTriangle and removed the affected accessor methods.
Which versions are affected by RUSTSEC-2025-0164?
1 open source package ship an affected version, including i_triangle.
| Package | Affected | Fixed in |
|---|---|---|
i_triangle crates.io | From 0.0.0-0 | 0.29.0 |
How do I fix RUSTSEC-2025-0164?
Upgrade i_triangle to 0.29.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2025-0164 being exploited?
There is no known exploitation of RUSTSEC-2025-0164 in the wild and no public exploit code.