GHSA-mj73-j457-8x9q
maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe
GHSA-mj73-j457-8x9q is a low vulnerability (CVSS 1.0) in maxminddb, published November 28, 2025. No source lists public exploit code. Fixed in maxminddb 0.27.0.
- Severity
- 1.0 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.27.0maxminddb
Description
maxminddb prior to version 0.27 declared Reader::open_mmap as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while the memory map was still active.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
maxminddbcrates.io | 0.11.0 up to 0.27.0 | 0.27.0 |
What each source reports
GitHub Advisories Score used
maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe
maxminddb prior to version 0.27 declared Reader::open_mmap as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while the memory map was still active.
- Record
GHSA-mj73-j457-8x9q- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-915
- Updated
- 2026-11-02
OSV
maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe
maxminddb prior to version 0.27 declared Reader::open_mmap as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while the memory map was still active.
- Record
GHSA-mj73-j457-8x9q- CVSS 4.0
- 1.0 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-915
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0132No score
`Reader::open_mmap` unsoundly marks unsafe memmap operation as safe
maxminddb prior to version 0.27 declared Reader::open_mmap as safe
despite wrapping an inherently unsafe memmap2 operation with no
extra step done to guarantee safety. This could have led to undefined
behaviour if the file were to be modified on disk while the memory map
was still active.
- Record
RUSTSEC-2025-0132- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.