{"id":"GHSA-qm2p-4w45-v2vr","aliases":["RUSTSEC-2025-0005"],"status":"published","title":"grcov has an out of bounds write triggered by crafted coverage data","description":"Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut` without validating that the index is in bounds.\n\nThis results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-01-13T12:00:00Z","modified":"2025-10-28T06:29:25Z","fixes":[{"ecosystem":"crates.io","package":"grcov","fixed_in":["0.8.20","0.8.21-0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"grcov","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.20"}]}]},{"source":"osv","ecosystem":"crates.io","package":"grcov","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.20"}]}]},{"source":"osv","ecosystem":"crates.io","package":"grcov","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.8.21-0"}]}]}],"references":[{"url":"https://github.com/mozilla/grcov/commit/c8219563bc91615dd4a27884a5c63f09db8d03bb","tags":["web"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1917475","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0005.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qm2p-4w45-v2vr"},{"url":"https://github.com/mozilla/grcov","tags":["package"]},{"url":"https://crates.io/crates/grcov","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-qm2p-4w45-v2vr","title":"grcov has an out of bounds write triggered by crafted coverage data","description":"Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut` without validating that the index is in bounds.\n\nThis results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.","status":"published","published":"2025-02-10T18:07:30Z","modified":"2025-02-10T18:07:31Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:38:29.866763Z"}],"osv":[{"id":"GHSA-qm2p-4w45-v2vr","title":"grcov has an out of bounds write triggered by crafted coverage data","description":"Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut` without validating that the index is in bounds.\n\nThis results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.","status":"published","published":"2025-02-10T18:07:30Z","modified":"2025-10-28T06:29:25.945179Z","cwes":["CWE-787"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"RUSTSEC-2025-0005","title":"Out of bounds write triggered by crafted coverage data","description":"Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut`\nwithout validating that the index is in bounds.\n\nThis results in memory corruption, and could potentially allow arbitrary code execution\nprovided that an attacker can feed the tool crafted coverage data.","status":"published","published":"2025-01-13T12:00:00Z","modified":"2025-10-28T06:29:25.945179Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}