Every CVE Search/ Get API key

CVE-2021-45686

Use of Uninitialized Resource in csv-sniffer.

9.8 CriticalFix available

An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.23%Up 0.6 points since Dec 27, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.

Record
CVE-2021-45686
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-908
Updated
2026-11-02
CVE List No score

An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.

Record
CVE-2021-45686
Updated
2026-11-02
EUVDEUVD-2022-0542 No score

An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.

Record
EUVD-2022-0542
Updated
2026-11-03
GitHub AdvisoriesGHSA-9783-42pm-x5jq 9.8

Use of Uninitialized Resource in csv-sniffer.

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Record
GHSA-9783-42pm-x5jq
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-908
Updated
2026-11-02
GitHub AdvisoriesGHSA-r67p-m7g9-gxw6 No score

`Read` on uninitialized memory may cause UB (fn preamble_skipcount())

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Record
GHSA-r67p-m7g9-gxw6
Updated
2026-11-02
OSVGHSA-9783-42pm-x5jq 9.8

Use of Uninitialized Resource in csv-sniffer.

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Record
GHSA-9783-42pm-x5jq
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-908
Updated
2026-11-02
OSVGHSA-r67p-m7g9-gxw6 No score

`Read` on uninitialized memory may cause UB (fn preamble_skipcount())

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Record
GHSA-r67p-m7g9-gxw6
Updated
2026-11-02
OSVRUSTSEC-2021-0088 No score

`Read` on uninitialized memory may cause UB (fn preamble_skipcount())

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Record
RUSTSEC-2021-0088
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
csv-sniffer
crates.io
before 0.2.0
0.2.0
csv-sniffer
crates.io
0.0.0-0 up to 0.2.0
0.2.0

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-45686 is a critical vulnerability (CVSS 9.8) in Csv-sniffer Project Csv-sniffer, published January 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in csv-sniffer 0.2.0.

References

MoveEnter Open