CVE-2020-35903
Out of bounds read in dync
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
- Record
CVE-2020-35903- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
- Record
CVE-2020-35903- Updated
- 2026-11-02
EUVDEUVD-2021-1852 No score
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
- Record
EUVD-2021-1852- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qxjq-v4wf-ppvh
Out of bounds read in dync
VecCopy::data is created as a Vec of u8 but can be used to store and retrieve elements of different types leading to misaligned access.
The issue was resolved in v0.5.0 by replacing data being stored by Vec<u8> with a custom managed pointer. Elements are now stored and retrieved using types with proper alignment corresponding to original types.
- Record
GHSA-qxjq-v4wf-ppvh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVGHSA-qxjq-v4wf-ppvh
Out of bounds read in dync
VecCopy::data is created as a Vec of u8 but can be used to store and retrieve elements of different types leading to misaligned access.
The issue was resolved in v0.5.0 by replacing data being stored by Vec<u8> with a custom managed pointer. Elements are now stored and retrieved using types with proper alignment corresponding to original types.
- Record
GHSA-qxjq-v4wf-ppvh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0050
VecCopy allows misaligned access to elements
VecCopy::data is created as a Vec of u8 but can be used to store and retrieve
elements of different types leading to misaligned access.
The issue was resolved in v0.5.0 by replacing data being stored by Vec<u8> with a custom managed
pointer. Elements are now stored and retrieved using types with proper alignment corresponding to
original types.
- Record
RUSTSEC-2020-0050- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35903 is a medium vulnerability (CVSS 5.5) in Dync Project Dync, published September 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in dync 0.5.0.