{"id":"CVE-2020-35864","aliases":["EUVD-2021-1677","GHSA-c9h5-hf8r-m97x","RUSTSEC-2020-0009"],"status":"published","title":"Dangling reference in flatbuffers","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00591,"percentile":0.48574,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-704"],"published":"2020-04-11T12:00:00Z","modified":"2026-10-24T10:30:16Z","fixes":[{"ecosystem":"crates.io","package":"flatbuffers","fixed_in":["2.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"flatbuffers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"flatbuffers","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"flatbuffers","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"2.0.0"}]}]}],"products":[{"vendor":"google","product":"flatbuffers"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0009.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35864","tags":["advisory"]},{"url":"https://github.com/google/flatbuffers/issues/5825","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-c9h5-hf8r-m97x"},{"url":"https://github.com/google/flatbuffers","tags":["package"]},{"url":"https://crates.io/crates/flatbuffers","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35864","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","status":"published","published":"2020-12-31T08:29:31Z","modified":"2024-08-04T17:16:12.667Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2021-1677","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","status":"published","published":"2020-12-31T08:29:31Z","modified":"2024-08-04T17:16:12Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-c9h5-hf8r-m97x","title":"Dangling reference in flatbuffers","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","status":"published","published":"2021-08-25T20:47:36Z","modified":"2023-06-13T17:18:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2020-35864","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","status":"published","published":"2020-12-31T10:15:15.16Z","modified":"2026-06-17T03:14:29.397Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35864","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","status":"published","published":"2020-12-31T10:15:15.16Z","modified":"2026-10-24T10:30:16.059114289Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-c9h5-hf8r-m97x","title":"Dangling reference in flatbuffers","description":"An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.","status":"published","published":"2021-08-25T20:47:36Z","modified":"2023-11-08T04:03:36.2768Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"RUSTSEC-2020-0009","title":"`read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocks","description":"The `read_scalar` and `read_scalar_at` functions are unsound\nbecause they allow transmuting values without `unsafe` blocks.\n\nThe following example shows how to create a dangling reference:\n\n```\nfn main() {\n    #[derive(Copy, Clone, PartialEq, Debug)]\n    struct S(\u0026'static str);\n    impl flatbuffers::EndianScalar for S {\n        fn to_little_endian(self) -\u003e Self { self }\n        fn from_little_endian(self) -\u003e Self { self }\n    }\n    println!(\"{:?}\", flatbuffers::read_scalar::\u003cS\u003e(\u0026[1; std::mem::size_of::\u003cS\u003e()]));\n}\n```","status":"published","published":"2020-04-11T12:00:00Z","modified":"2023-11-08T04:03:36.2768Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}