CVE-2020-36433
Unaligned memory allocation in chunky
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
- Record
CVE-2020-36433- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
- Record
CVE-2020-36433- Updated
- 2026-11-02
EUVDEUVD-2021-1842 No score
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
- Record
EUVD-2021-1842- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qg24-8xj4-gj2h
Unaligned memory allocation in chunky
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
- Record
GHSA-qg24-8xj4-gj2h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-758
- Updated
- 2026-11-02
OSVGHSA-qg24-8xj4-gj2h
Unaligned memory allocation in chunky
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
- Record
GHSA-qg24-8xj4-gj2h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-758
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0035
Chunk API does not respect align requirement
Chunk API does not respect the align requirement of types. Unaligned reference can be created with the API, which is an undefined behavior.
- Record
RUSTSEC-2020-0035- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36433 is a high vulnerability (CVSS 7.5) in Aeplay Chunky, published August 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. No source names a fixed version.