GHSA-qm2p-4w45-v2vr
grcov has an out of bounds write triggered by crafted coverage data
Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut without validating that the index is in bounds.
This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.
What each source reports
GitHub AdvisoriesNo score
grcov has an out of bounds write triggered by crafted coverage data
Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut without validating that the index is in bounds.
This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.
- Record
GHSA-qm2p-4w45-v2vr- Weakness
- CWE-787
- Updated
- 2026-11-02
OSVNo score
grcov has an out of bounds write triggered by crafted coverage data
Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut without validating that the index is in bounds.
This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.
- Record
GHSA-qm2p-4w45-v2vr- Weakness
- CWE-787
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0005No score
Out of bounds write triggered by crafted coverage data
Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut
without validating that the index is in bounds.
This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.
- Record
RUSTSEC-2025-0005- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-qm2p-4w45-v2vr is a vulnerability with no CVSS score yet in grcov, published January 13, 2025. No source lists public exploit code. Fixed in grcov 0.8.20.