RUSTSEC-2026-0191 json
`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic
published 5mo ago modified 4mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Affected versions of `solana_rbpf` expose the safe method `EbpfVm::invoke_function`. This method computes an obfuscated VM pointer by casting `self` to `*mut u64` and applying a randomized offset derived from `get_runtime_environment_key()`.
The resulting pointer arithmetic is performed with `ptr::offset`, which requires the computed pointer to remain within the same allocation. In practice, the randomized offset can move the pointer far outside the allocation containing the `EbpfVm`, causing undefined behavior before the supplied builtin function is invoked.
## Unmaintained
The upstream `solana_rbpf` repository is archived, and no patched version of this crate is currently available.
Users should migrate to the maintained [`solana-sbpf`](https://crates.io/crates/solana-sbpf) crate. The issue has been fixed there in [`anza-xyz/sbpf#151`](https://github.com/anza-xyz/sbpf/pull/151).
Patch / fix
- github.com/anza-xyz/sbpf#151 pull request
Is RUSTSEC-2026-0191 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | solana_rbpf | >=0.8.0 |
no fix listed |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.