RUSTSEC-2025-0167 `Bitmap::try_from(&[u8])` can create invalid values
An attacker can trigger undefined behavior and potential code execution by providing invalid byte inputs to the Bitmap constructor in this unmaintained Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2025-0167?
RUSTSEC-2025-0167 is a memory corruption vulnerability in bitmaps, published on 25 Dec 2025.
Official description
The TryFrom<&[u8]> implementation for Bitmap<SIZE> copies the input bytes
into an uninitialized backing store and calls assume_init() without
validating that the bytes form a valid value of the backing store type. For
SIZE = 1 the backing store is a bool, so any input byte other than 0x00
or 0x01 produces an invalid value, which is immediate undefined behavior.
The AsMut<[u8]> implementation has the same problem, as it allows safe code
to write invalid bit patterns into the backing store through the returned slice.
No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.
Which versions are affected by RUSTSEC-2025-0167?
1 open source package ship an affected version, including bitmaps.
| Package | Affected | Fixed in |
|---|---|---|
bitmaps crates.io | From 3.2.0 | None |
How do I fix RUSTSEC-2025-0167?
No fix has been published for RUSTSEC-2025-0167 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2025-0167 being exploited?
There is no known exploitation of RUSTSEC-2025-0167 in the wild and no public exploit code.