GHSA-x43w-ph7m-pfjx
hexchat crate has a Use After Free vulnerability
GHSA-x43w-ph7m-pfjx is a high vulnerability (CVSS 7.2) in hexchat, published November 17, 2025. No source lists public exploit code. No source names a fixed version.
- Severity
- 7.2 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
All versions of this crate have function deregister_command which can result in use after free. This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the hexchat crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
What each source reports
GitHub Advisories Score used
hexchat crate has a Use After Free vulnerability
All versions of this crate have function deregister_command which can result in use after free. This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the hexchat crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.
- Record
GHSA-x43w-ph7m-pfjx- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
hexchat crate has a Use After Free vulnerability
All versions of this crate have function deregister_command which can result in use after free. This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the hexchat crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.
- Record
GHSA-x43w-ph7m-pfjx- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0153No score
hexchat crate is unsound and unmaintained
All versions of this crate have function deregister_command which can result in use after free.
This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the hexchat crate is no longer actively maintained. If you rely on this crate, consider switching
to an alternative.
- Record
RUSTSEC-2025-0153- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.