PT-2025-45795 · Crates.Io · Borrowck Sacrifices

Published 2025-10-22 · Updated 2025-10-22

OSV

CVSS v4.0

2.0

Low

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

The safe function any as u8 slice can create byte slices that reference uninitialized memory when used with types containing padding bytes.

The function uses slice::from raw parts to create a &[u8] covering the entire size of a type, including padding bytes. According to Rust's documentation, from raw parts requires all bytes to be properly initialized, but padding bytes in structs are not guaranteed to be initialized. This violates the safety contract and causes undefined behavior.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

GHSA-XCPM-76HF-C9CC

Affected Products

Borrowck Sacrifices

References · 5

• https://osv.dev/vulnerability/GHSA-xcpm-76hf-c9cc · Vendor Advisory
• https://github.com/alexpyattaev/borrowck_sacrifices · Note
• https://github.com/alexpyattaev/borrowck_sacrifices/commit/1bdaa14da68a6e8207f9e81359116f53139800f2 · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0107.html · Note
• https://github.com/alexpyattaev/borrowck_sacrifices/issues/1 · Note