CVE-2026-92612CWE-749

CVE-2026-92612

published September 21, 2026

CVSS
1.0
EPSS
0%
Percentile
4.1
In the wild
Unconfirmed
What it is

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.

The record
Technical detail
CVSS
1.0 · NONE
CVSS v4.0
1.0 · CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00153 · 4.1th percentile
Weakness
CWE-749 · Exposed Dangerous Method or Function
Published
2026-09-21T15:17Z
References (5)
https://crates.io/crates/iceoryx2-bb-container/0.10.0 · [email protected]https://github.com/eclipse-iceoryx/iceoryx2/releases/tag/v0.10.0 · [email protected]https://github.com/eclipse-iceoryx/iceoryx2/security/advisories/GHSA-8mq4-3mwq-qvg6 · [email protected]https://gitlab.eclipse.org/security/cve-assignment/-/work_items/307 · [email protected]https://github.com/eclipse-iceoryx/iceoryx2/security/advisories/GHSA-8mq4-3mwq-qvg6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 10:47Z
    In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts…
    cvelistv5