RUSTSEC-2026-0197
`Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices
The Matrix2::swap_columns, Matrix3::swap_columns, and Matrix4::swap_columns
implementations call ptr::swap(&mut self[a], &mut self[b]).
When a == b, these safe APIs create two mutable references to the same matrix
column and pass them to ptr::swap. This violates Rust's aliasing rules and can
trigger undefined behavior. The issue can be reproduced from safe Rust by calling
swap_columns with identical column indices, for example m.swap_columns(0, 0).
A minimal fix is to return early when the two column indices are equal before
calling ptr::swap.
What each source reports
OSV No score
`Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices
The Matrix2::swap_columns, Matrix3::swap_columns, and Matrix4::swap_columns
implementations call ptr::swap(&mut self[a], &mut self[b]).
When a == b, these safe APIs create two mutable references to the same matrix
column and pass them to ptr::swap. This violates Rust's aliasing rules and can
trigger undefined behavior. The issue can be reproduced from safe Rust by calling
swap_columns with identical column indices, for example m.swap_columns(0, 0).
A minimal fix is to return early when the two column indices are equal before
calling ptr::swap.
- Record
RUSTSEC-2026-0197- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cgmathcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0197 is a vulnerability with no CVSS score yet in cgmath, published March 11, 2026. No source lists public exploit code. No source names a fixed version.