RUSTSEC-2025-0165 i_tree allowed out-of-bounds access through safe public node accessors
Attackers can trigger undefined behavior and potential code execution by passing out-of-bounds indices to safe public node accessors in the i_tree library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2025-0165?
RUSTSEC-2025-0165 is a memory corruption vulnerability in i_tree, published on 4 Jul 2025.
Official description
Affected versions of i_tree exposed safe public Tree::node and Tree::mut_node methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::get_unchecked / get_unchecked_mut on the internal node buffer, without validating that the index was in bounds.
Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any unsafe code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.
Starting with 0.10.0 the crate was restructured and these accessors are no longer reachable from outside the crate.
Which versions are affected by RUSTSEC-2025-0165?
1 open source package ship an affected version, including i_tree.
| Package | Affected | Fixed in |
|---|---|---|
i_tree crates.io | From 0.0.0-0 | 0.10.0 |
How do I fix RUSTSEC-2025-0165?
Upgrade i_tree to 0.10.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2025-0165 being exploited?
There is no known exploitation of RUSTSEC-2025-0165 in the wild and no public exploit code.