Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0123

Out-of-bounds read in `bytes_helper` public safe functions

Published May 2, 2026 · Updated May 12, 2026 · Assigned by RUSTSEC

Description

The `bytes_helper` module contains multiple public functions
(`into_arr4()`, `into_arr2()`, `u8_from_le_bytes()`) that use
`slice.get_unchecked(pos..pos + N)` without verifying that
`pos + N <= slice.len()`. These are public safe API functions, allowing any
caller to trigger undefined behavior by passing invalid positions.

For example, calling `into_arr4(&data, 10)` where `data` is a 3-byte slice
causes an out-of-bounds access since position 10 exceeds the slice length.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io rustdx >= 0.0.0-0, < 0.4.4 0.4.4 RUSTSEC-2026-0123

References