RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2`
Attackers can trigger undefined behavior and potential crashes by passing invalid offsets to memory mapping functions in the memmap2 Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0186?
RUSTSEC-2026-0186 is a vulnerability in memmap2, published on 20 Jun 2026.
Official description
Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of
Mmap::[unchecked_]advise_range(),
MmapMut::[unchecked_]advise_ranage()
and MmapMut::flush[_async]_range().
This can cause undefined behavior due to invalid values being passed to pointer::offset() and pointer::add()
when passing an out-of-bounds range to any of the affected functions.
The flaw was corrected in commit [cee7cf0] and released in version 0.9.11.
The invalid pointer is not dereferenced,
but it is passed to the madvise and msync syscalls and their Windows equivalents.
[cee7cf0] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c
Which versions are affected by RUSTSEC-2026-0186?
1 open source package ship an affected version, including memmap2.
| Package | Affected | Fixed in |
|---|---|---|
memmap2 crates.io | From 0.0.0-0 | 0.9.11 |
How do I fix RUSTSEC-2026-0186?
Upgrade memmap2 to 0.9.11 or later.
Is RUSTSEC-2026-0186 being exploited?
There is no known exploitation of RUSTSEC-2026-0186 in the wild and no public exploit code.