Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0202

`let_cxx_string!` uses uninitialized value due to exception safety violations

Published Jul 5, 2026 · Updated Jul 5, 2026 · Assigned by RUSTSEC

Description

In affected versions of this crate, `let_cxx_string!` is not exception safe. After creating the `StackString`, if `match $value` panics, the content of `StackString` is not yet initialized, while the drop implementation of `StackString` unconditionally deinitializes the content, leading to use of uninitialized value.

The soundness issue was fixed in version `1.0.195` by moving drop logics to separate drop guard after initializing the `StackString`.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io cxx >= 0.0.0-0, < 1.0.195 1.0.195 RUSTSEC-2026-0202

References