CVE-2019-15552
Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
CVE-2019-15552- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
CVE-2019-15552- Updated
- 2026-11-02
EUVDEUVD-2021-1873 No score
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
EUVD-2021-1873- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpcm-whqc-jfw8
Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
GHSA-rpcm-whqc-jfw8- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
CVE-2019-15552- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-15552
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
DEBIAN-CVE-2019-15552- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rpcm-whqc-jfw8
Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
GHSA-rpcm-whqc-jfw8- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRUSTSEC-2019-0010
MultiDecoder::read() drops uninitialized memory of arbitrary type on panic in client code
Affected versions of libflate have set a field of an internal structure with a generic type to an uninitialized value in MultiDecoder::read() and reverted it to the original value after the function completed. However, execution of MultiDecoder::read() could be interrupted by a panic in caller-supplied Read implementation. This would cause drop() to be called on uninitialized memory of a generic type implementing Read.
This is equivalent to a use-after-free vulnerability and could allow an attacker to gain arbitrary code execution.
The flaw was corrected by aborting immediately instead of unwinding the stack in case of panic within MultiDecoder::read(). The issue was discovered and fixed by Shnatsel.
- Record
RUSTSEC-2019-0010- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-15552
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Record
UBUNTU-CVE-2019-15552- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libflatecrates.io |
0.1.14 up to 0.1.25 | 0.1.25 |
rust-libflateDebian:12 |
before 0.1.25-1 | 0.1.25-1 |
rust-libflateDebian:13 |
before 0.1.25-1 | 0.1.25-1 |
rust-libflateDebian:14 |
before 0.1.25-1 | 0.1.25-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15552 is a critical vulnerability (CVSS 9.8) in Libflate Project Libflate, published July 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in libflate 0.1.25.