{"id":"RUSTSEC-2025-0167","summary":"`Bitmap::try_from(&[u8])` can create invalid values","details":"The `TryFrom\u003c&[u8]\u003e` implementation for `Bitmap\u003cSIZE\u003e` copies the input bytes\ninto an uninitialized backing store and calls `assume_init()` without\nvalidating that the bytes form a valid value of the backing store type. For\n`SIZE = 1` the backing store is a `bool`, so any input byte other than `0x00`\nor `0x01` produces an invalid value, which is immediate undefined behavior.\n\nThe `AsMut\u003c[u8]\u003e` implementation has the same problem, as it allows safe code\nto write invalid bit patterns into the backing store through the returned slice.\n\nNo fixed version is available, as the crate is unmaintained; its GitHub\nrepository was archived by the owner on 2026-05-03.","modified":"2026-08-10T19:45:04.530683607Z","published":"2025-12-25T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/bitmaps"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2025-0167.html"},{"type":"REPORT","url":"https://github.com/bodil/bitmaps/issues/35"}],"affected":[{"package":{"name":"bitmaps","ecosystem":"crates.io","purl":"pkg:cargo/bitmaps"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":[],"arch":[],"os":[]}},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0167.json"}}],"schema_version":"1.8.0"}