RUSTSEC-2025-0166 Multiple soundness issues in `stackvector`
Safe Rust code can trigger undefined behavior via out-of-bounds memory access in the stackvector library, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2025-0166?
RUSTSEC-2025-0166 is a memory corruption vulnerability in stackvector, published on 23 Oct 2025.
Official description
Affected versions of stackvector contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.
One issue was that StackVec::length was exposed as a public field. Safe Rust code could set length to a value larger than the backing array capacity. Other safe methods, including remove, pop, and truncate, relied on length before performing unsafe pointer operations (ptr::read, ptr::copy, offset/add). If length was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.
The upstream maintainer also identified additional soundness issues, including the use of mem::uninitialized in StackVec::from_vec_unchecked, which was reachable through from_vec, and Miri violations related to MaybeUninit usage.
Version 2.0.0 was released to fix the known soundness issues.
Which versions are affected by RUSTSEC-2025-0166?
1 open source package ship an affected version, including stackvector.
| Package | Affected | Fixed in |
|---|---|---|
stackvector crates.io | From 0.0.0-0 | 2.0.0 |
How do I fix RUSTSEC-2025-0166?
Upgrade stackvector to 2.0.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2025-0166 being exploited?
There is no known exploitation of RUSTSEC-2025-0166 in the wild and no public exploit code.