CVE-2019-15553
Exposure of uninitialized memory in memoffset
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Record
CVE-2019-15553- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Record
CVE-2019-15553- Updated
- 2026-11-02
EUVDEUVD-2021-1869 No score
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Record
EUVD-2021-1869- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rh89-x75f-rh3c
Exposure of uninitialized memory in memoffset
Affected versions of this crate caused traps and/or memory unsafety by zero-initializing references. They also could lead to uninitialized memory being dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic. The flaw was corrected by using MaybeUninit.
- Record
GHSA-rh89-x75f-rh3c- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSV
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Record
CVE-2019-15553- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-15553
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Record
DEBIAN-CVE-2019-15553- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-rh89-x75f-rh3c
Exposure of uninitialized memory in memoffset
Affected versions of this crate caused traps and/or memory unsafety by zero-initializing references. They also could lead to uninitialized memory being dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic. The flaw was corrected by using MaybeUninit.
- Record
GHSA-rh89-x75f-rh3c- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVRUSTSEC-2019-0011
Flaw in offset_of and span_of causes SIGILL, drops uninitialized memory of arbitrary type on panic in client code
Affected versions of this crate caused traps and/or memory unsafety by zero-initializing references. They also could lead to uninitialized memory being dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic.
The flaw was corrected by using MaybeUninit.
- Record
RUSTSEC-2019-0011- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-15553
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Record
UBUNTU-CVE-2019-15553- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
memoffsetcrates.io |
before 0.5.0 | 0.5.0 |
rust-memoffsetDebian:12 |
before 0.5.1-1 | 0.5.1-1 |
rust-memoffsetDebian:13 |
before 0.5.1-1 | 0.5.1-1 |
rust-memoffsetDebian:14 |
before 0.5.1-1 | 0.5.1-1 |
memoffsetcrates.io |
0.0.0-0 up to 0.5.0 | 0.5.0 |
rust-memoffsetUbuntu:20.04:LTS |
All versions, plus listed versions 0.2.1-10.5.3-1 |
None known |
rust-memoffsetUbuntu:22.04:LTS |
All versions, plus listed versions 0.5.3-10.6.4-1 |
None known |
rust-memoffsetUbuntu:24.04:LTS |
All versions, plus listed versions 0.6.5-1 |
None known |
rust-memoffsetUbuntu:25.10 |
All versions, plus listed versions 0.8.0-1 |
None known |
rust-memoffsetUbuntu:26.10 |
All versions, plus listed versions 0.8.0-1 |
None known |
rust-memoffsetUbuntu:26.04:LTS |
All versions, plus listed versions 0.8.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15553 is a high vulnerability (CVSS 7.5) in Memoffset Project Memoffset, published July 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in memoffset 0.5.0.
References
rustsec.org/advisories/RUSTSEC-2019-0011.html
github.com/Gilnaa/memoffset/issues/9
nvd.nist.gov/vuln/detail/CVE-2019-15553
security-tracker.debian.org/tracker/CVE-2019-15553
crates.io/crates/memoffset
ubuntu.com/security/CVE-2019-15553
cve.org/CVERecord?id=CVE-2019-15553