rustsec-2026-0202
Vulnerability from osv_rustsec
Published
2026-07-05 12:00
Modified
2026-07-05 08:34
Summary
`let_cxx_string!` uses uninitialized value due to exception safety violations
Details

In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.

The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-exposure"
        ],
        "cvss": null,
        "informational": "unsound"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "cxx::let_cxx_string"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "cxx",
        "purl": "pkg:cargo/cxx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "1.0.195"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "In affected versions of this crate, `let_cxx_string!` is not exception safe. After creating the `StackString`, if `match $value` panics, the content of `StackString` is not yet initialized, while the drop implementation of `StackString` unconditionally deinitializes the content, leading to use of uninitialized value.\n\nThe soundness issue was fixed in version `1.0.195` by moving drop logics to separate drop guard after initializing the `StackString`.",
  "id": "RUSTSEC-2026-0202",
  "modified": "2026-07-05T08:34:37Z",
  "published": "2026-07-05T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/cxx"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0202.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dtolnay/cxx/issues/1729"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`let_cxx_string!` uses uninitialized value due to exception safety violations"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.