{"id":"RUSTSEC-2026-0202","summary":"`let_cxx_string!` uses uninitialized value due to exception safety violations","details":"In affected versions of this crate, `let_cxx_string!` is not exception safe. After creating the `StackString`, if `match $value` panics, the content of `StackString` is not yet initialized, while the drop implementation of `StackString` unconditionally deinitializes the content, leading to use of uninitialized value.\n\nThe soundness issue was fixed in version `1.0.195` by moving drop logics to separate drop guard after initializing the `StackString`.","modified":"2026-07-05T08:45:04.168768726Z","published":"2026-07-05T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/cxx"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0202.html"},{"type":"REPORT","url":"https://github.com/dtolnay/cxx/issues/1729"}],"affected":[{"package":{"name":"cxx","ecosystem":"crates.io","purl":"pkg:cargo/cxx"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.0.195"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":["cxx::let_cxx_string"]},"affected_functions":null},"database_specific":{"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0202.json","categories":["memory-exposure"]}}],"schema_version":"1.7.5"}