RUSTSEC-2026-0186 json
Unchecked pointer offset in crate `memmap2`
published 4mo ago modified 4mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Affected versionf of `memmap2` did not perform enough validation on the `offset` and `len` parameters of `Mmap::[unchecked_]advise_range()`, `MmapMut::[unchecked_]advise_ranage()` and `MmapMut::flush[_async]_range()`.
This can cause undefined behavior due to invalid values being passed to [`pointer::offset()`] and [`pointer::add()`] when passing an out-of-bounds range to any of the affected functions.
The flaw was corrected in commit [`cee7cf0`] and released in version `0.9.11`.
The invalid pointer is not dereferenced, but it is passed to the `madvise` and `msync` syscalls and their Windows equivalents.
[`pointer::offset()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.offset-1 [`pointer::add()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.add-1 [`cee7cf0`] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c
Patch / fix
Is RUSTSEC-2026-0186 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | memmap2 | >=0.0.0-0, <0.9.11 |
0.9.11 |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.