{"id":"RUSTSEC-2026-0191","aliases":[],"status":"published","title":"`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic","description":"Affected versions of `solana_rbpf` expose the safe method\n`EbpfVm::invoke_function`. This method computes an obfuscated VM pointer by\ncasting `self` to `*mut u64` and applying a randomized offset derived from\n`get_runtime_environment_key()`.\n\nThe resulting pointer arithmetic is performed with `ptr::offset`, which\nrequires the computed pointer to remain within the same allocation. In practice,\nthe randomized offset can move the pointer far outside the allocation\ncontaining the `EbpfVm`, causing undefined behavior before the supplied builtin\nfunction is invoked.\n\n## Unmaintained\n\nThe upstream `solana_rbpf` repository is archived, and no patched version of\nthis crate is currently available.\n\nUsers should migrate to the maintained [`solana-sbpf`](https://crates.io/crates/solana-sbpf)\ncrate. The issue has been fixed there in\n[`anza-xyz/sbpf#151`](https://github.com/anza-xyz/sbpf/pull/151).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-05-28T12:00:00Z","modified":"2026-06-29T14:45:04Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"solana_rbpf","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"}]}]}],"references":[{"url":"https://crates.io/crates/solana_rbpf","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0191.html","tags":["advisory"]},{"url":"https://github.com/solana-labs/rbpf","tags":["web"]},{"url":"https://github.com/anza-xyz/sbpf/pull/151","tags":["web"]},{"url":"https://crates.io/crates/solana-sbpf","tags":["package"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0191","title":"`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic","description":"Affected versions of `solana_rbpf` expose the safe method\n`EbpfVm::invoke_function`. This method computes an obfuscated VM pointer by\ncasting `self` to `*mut u64` and applying a randomized offset derived from\n`get_runtime_environment_key()`.\n\nThe resulting pointer arithmetic is performed with `ptr::offset`, which\nrequires the computed pointer to remain within the same allocation. In practice,\nthe randomized offset can move the pointer far outside the allocation\ncontaining the `EbpfVm`, causing undefined behavior before the supplied builtin\nfunction is invoked.\n\n## Unmaintained\n\nThe upstream `solana_rbpf` repository is archived, and no patched version of\nthis crate is currently available.\n\nUsers should migrate to the maintained [`solana-sbpf`](https://crates.io/crates/solana-sbpf)\ncrate. The issue has been fixed there in\n[`anza-xyz/sbpf#151`](https://github.com/anza-xyz/sbpf/pull/151).","status":"published","published":"2026-05-28T12:00:00Z","modified":"2026-06-29T14:45:04.175629528Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}