grcov has an out of bounds write triggered by crafted coverage data

published 2025-01-13 last yr. modified 2025-10-28 last yr. also RUSTSEC-2025-0005

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut` without validating that the index is in bounds.

This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.

Patch / fix

fixed in 1 links 1

crates.io grcov 0.8.20, 0.8.21-0

github.com/mozilla/grcov@c821956 commit

Is GHSA-qm2p-4w45-v2vr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	grcov	<0.8.20 >=0.0.0-0, <0.8.21-0	0.8.20 0.8.21-0

Classification

Weakness

CWE-787 Out-of-bounds Write

References

github.com /mozilla/grcov/commit/c8219563bc91615dd4a27884a5c63f09db8d03bb
web
bugzilla.mozilla.org /show_bug.cgi?id=1917475
web
github.com /mozilla/grcov
package
rustsec.org /advisories/RUSTSEC-2025-0005.html
web, advisory
crates.io /crates/grcov
package

Sources

GitHub Advisory GHSA-qm2p-4w45-v2vr
OSV RUSTSEC-2025-0005

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.