GHSA-h5j3-crg5-8jqm
orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
GHSA-h5j3-crg5-8jqm is a low vulnerability (CVSS 2.0) in orx-pinned-vec, published October 21, 2025. No source lists public exploit code. Fixed in orx-pinned-vec 3.21.0.
- Severity
- 2.0 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.21.0orx-pinned-vec +1 more
Description
The safe function index_of_ptr causes undefined behavior when called with an empty slice.
The issue occurs in the line ptr.add(slice.len() - 1) which underflows when slice.len() is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
orx-pinned-veccrates.io | before 3.21.0 | 3.21.0 |
orx-pinned-veccrates.io | 0.0.0-0 up to 3.21.0 | 3.21.0 |
What each source reports
GitHub Advisories Score used
orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
The safe function index_of_ptr causes undefined behavior when called with an empty slice.
The issue occurs in the line ptr.add(slice.len() - 1) which underflows when slice.len() is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.
- Record
GHSA-h5j3-crg5-8jqm- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119, CWE-191
- Updated
- 2026-11-02
OSV
orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
The safe function index_of_ptr causes undefined behavior when called with an empty slice.
The issue occurs in the line ptr.add(slice.len() - 1) which underflows when slice.len() is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.
- Record
GHSA-h5j3-crg5-8jqm- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119, CWE-191
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0106No score
Undefined behavior in index_of_ptr with empty slices
The safe function index_of_ptr causes undefined behavior when called with an empty slice.
The issue occurs in the line ptr.add(slice.len() - 1) which underflows when slice.len() is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.
- Record
RUSTSEC-2025-0106- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/orxfun/orx-pinned-vec/issues/52
rustsec.org/advisories/RUSTSEC-2025-0106.html
crates.io/crates/orx-pinned-vec