CVE-2021-25906
Double free in basic_dsp_matrix
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
- Record
CVE-2021-25906- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
- Record
CVE-2021-25906- Updated
- 2026-11-02
EUVDEUVD-2021-1704 No score
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
- Record
EUVD-2021-1704- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjr6-hm39-4cf9
Double free in basic_dsp_matrix
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
- Record
GHSA-fjr6-hm39-4cf9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVGHSA-fjr6-hm39-4cf9
Double free in basic_dsp_matrix
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
- Record
GHSA-fjr6-hm39-4cf9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0009
panic safety issue in `impl TransformContent<S, D> for [S; (2|3|4)]`
Affected versions of this crate did not guard against double drop while temporarily duplicating objects' ownership using ptr::read(). Upon panic in a user-provided function conversion, objects that are copied by ptr::read() are dropped twice, leading to memory corruption.
The flaw was corrected in v0.9.2 by using ManuallyDrop<T> to enclose objects that are to be temporarily duplicated.
- Record
RUSTSEC-2021-0009- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
basic_dsp_matrixcrates.io |
before 0.9.2 | 0.9.2 |
basic_dsp_matrixcrates.io |
0.0.0-0 up to 0.9.2 | 0.9.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-25906 is a high vulnerability (CVSS 7.5) in Basic Dsp Matrix Project Dsp Matrix, published January 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in basic_dsp_matrix 0.9.2.