RUSTSEC-2026-0202
`let_cxx_string!` uses uninitialized value due to exception safety violations
In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.
The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.
What each source reports
OSV No score
`let_cxx_string!` uses uninitialized value due to exception safety violations
In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.
The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.
- Record
RUSTSEC-2026-0202- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cxxcrates.io |
0.0.0-0 up to 1.0.195 | 1.0.195 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0202 is a vulnerability with no CVSS score yet in cxx, published July 5, 2026. No source lists public exploit code. Fixed in cxx 1.0.195.