{"answers":{"affected":"1 open source package ship an affected version, including memmap2.","exploited":"There is no known exploitation of RUSTSEC-2026-0186 in the wild and no public exploit code.","fix":"Upgrade memmap2 to 0.9.11 or later.","what":"RUSTSEC-2026-0186 is a vulnerability in memmap2, published on 20 Jun 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0186 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0186 is a vulnerability in memmap2, published on 20 Jun 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0186 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- memmap2 (crates.io): affected from 0.0.0-0; fixed in 0.9.11\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0186/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0186/index.md)","id":"RUSTSEC-2026-0186","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0186/index.md","name":"RUSTSEC-2026-0186","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service","other"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust memory mapping library","requires_auth":"none","summary":"Attackers can trigger undefined behavior and potential crashes by passing invalid offsets to memory mapping functions in the memmap2 Rust library.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Affected versionf of `memmap2` did not perform enough validation on the `offset` and `len` parameters of\n`Mmap::[unchecked_]advise_range()`,\n`MmapMut::[unchecked_]advise_ranage()`\nand `MmapMut::flush[_async]_range()`.\n\nThis can cause undefined behavior due to invalid values being passed to [`pointer::offset()`] and [`pointer::add()`]\nwhen passing an out-of-bounds range to any of the affected functions.\n\nThe flaw was corrected in commit [`cee7cf0`] and released in version `0.9.11`.\n\nThe invalid pointer is not dereferenced,\nbut it is passed to the `madvise` and `msync` syscalls and their Windows equivalents.\n\n[`pointer::offset()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.offset-1\n[`pointer::add()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.add-1\n[`cee7cf0`] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Unchecked pointer offset in crate `memmap2`","id":"RUSTSEC-2026-0186","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.9.11"],"introduced":["0.0.0-0"],"last_affected":[],"package":"memmap2","purl":"pkg:cargo/memmap2","source":"RUSTSEC-2026-0186"}],"products":null,"published":"2026-06-20","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can trigger undefined behavior and potential crashes by passing invalid offsets to memory mapping functions in the memmap2 Rust library.","url":"https://insights.sbomify.com/RUSTSEC-2026-0186/"}