RUSTSEC-2025-0167
`Bitmap::try_from(&[u8])` can create invalid values
The TryFrom<&[u8]> implementation for Bitmap<SIZE> copies the input bytes
into an uninitialized backing store and calls assume_init() without
validating that the bytes form a valid value of the backing store type. For
SIZE = 1 the backing store is a bool, so any input byte other than 0x00
or 0x01 produces an invalid value, which is immediate undefined behavior.
The AsMut<[u8]> implementation has the same problem, as it allows safe code
to write invalid bit patterns into the backing store through the returned slice.
No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.
What each source reports
OSV No score
`Bitmap::try_from(&[u8])` can create invalid values
The TryFrom<&[u8]> implementation for Bitmap<SIZE> copies the input bytes
into an uninitialized backing store and calls assume_init() without
validating that the bytes form a valid value of the backing store type. For
SIZE = 1 the backing store is a bool, so any input byte other than 0x00
or 0x01 produces an invalid value, which is immediate undefined behavior.
The AsMut<[u8]> implementation has the same problem, as it allows safe code
to write invalid bit patterns into the backing store through the returned slice.
No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.
- Record
RUSTSEC-2025-0167- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bitmapscrates.io |
3.2.0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2025-0167 is a vulnerability with no CVSS score yet in bitmaps, published December 25, 2025. No source lists public exploit code. No source names a fixed version.