RUSTSEC-2026-0202 `let_cxx_string!` uses uninitialized value due to exception safety violations
Attackers can trigger use of uninitialized memory via panics in let_cxx_string!, potentially causing crashes or code execution in Rust applications using this crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0202?
RUSTSEC-2026-0202 is an use after free vulnerability in cxx, published on 5 Jul 2026.
Official description
In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.
The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.
Which versions are affected by RUSTSEC-2026-0202?
1 open source package ship an affected version, including cxx.
| Package | Affected | Fixed in |
|---|---|---|
cxx crates.io | From 0.0.0-0 | 1.0.195 |
How do I fix RUSTSEC-2026-0202?
Upgrade cxx to 1.0.195 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0202 being exploited?
There is no known exploitation of RUSTSEC-2026-0202 in the wild and no public exploit code.