{"id":"RUSTSEC-2026-0204","aliases":[],"status":"published","title":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","description":"Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-06T12:00:00Z","modified":"2026-07-06T22:30:04Z","fixes":[{"ecosystem":"crates.io","package":"crossbeam-epoch","fixed_in":["0.9.20"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"crossbeam-epoch","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.9.20"}]}]}],"references":[{"url":"https://crates.io/crates/crossbeam-epoch","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0204.html","tags":["advisory"]},{"url":"https://github.com/crossbeam-rs/crossbeam/pull/1276","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0204","title":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","description":"Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.","status":"published","published":"2026-07-06T12:00:00Z","modified":"2026-07-06T22:30:04.159269138Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}