Skip to content
Fencer Intel
no cvss —

RUSTSEC-2026-0186 json

Unchecked pointer offset in crate `memmap2`

published 4mo ago modified 4mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Affected versionf of `memmap2` did not perform enough validation on the `offset` and `len` parameters of `Mmap::[unchecked_]advise_range()`, `MmapMut::[unchecked_]advise_ranage()` and `MmapMut::flush[_async]_range()`.

This can cause undefined behavior due to invalid values being passed to [`pointer::offset()`] and [`pointer::add()`] when passing an out-of-bounds range to any of the affected functions.

The flaw was corrected in commit [`cee7cf0`] and released in version `0.9.11`.

The invalid pointer is not dereferenced, but it is passed to the `madvise` and `msync` syscalls and their Windows equivalents.

[`pointer::offset()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.offset-1 [`pointer::add()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.add-1 [`cee7cf0`] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c

Patch / fix

  • crates.io memmap2 0.9.11

Is RUSTSEC-2026-0186 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io memmap2
>=0.0.0-0, <0.9.11
0.9.11

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.