Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0186

Unchecked pointer offset in crate `memmap2`

Published Jun 20, 2026 · Updated Jun 22, 2026 · Assigned by RUSTSEC

Description

Affected versionf of `memmap2` did not perform enough validation on the `offset` and `len` parameters of
`Mmap::[unchecked_]advise_range()`,
`MmapMut::[unchecked_]advise_ranage()`
and `MmapMut::flush[_async]_range()`.

This can cause undefined behavior due to invalid values being passed to [`pointer::offset()`] and [`pointer::add()`]
when passing an out-of-bounds range to any of the affected functions.

The flaw was corrected in commit [`cee7cf0`] and released in version `0.9.11`.

The invalid pointer is not dereferenced,
but it is passed to the `madvise` and `msync` syscalls and their Windows equivalents.

[`pointer::offset()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.offset-1
[`pointer::add()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.add-1
[`cee7cf0`] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io memmap2 >= 0.0.0-0, < 0.9.11 0.9.11 RUSTSEC-2026-0186

References