XMP Toolkit's `XmpFile::close` can trigger undefined behavior
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Affected versions of the crate failed to catch C++ exceptions raised within the `XmpFile::close` function. If such an exception occurred, it would trigger undefined behavior, typically a process abort. This is best demonstrated in [issue #230](https://github.com/adobe/xmp-toolkit-rs/issues/230), where a race condition causes the `close` call to fail due to file I/O errors. This was fixed in [PR #232](https://github.com/adobe/xmp-toolkit-rs/pull/232) (released as crate version 1.9.0), which now safely handles the exception. For backward compatibility, the existing API ignores the error. A new API `XmpFile::try_close` was added to allow callers to receive and process the error result. Users of all prior versions of `xmp_toolkit` are encouraged to update to version 1.9.0 to avoid undefined behavior.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | xmp_toolkit (crates.io) | before 1.9.0 | 1.9.0 | Patch available | GHSA-66fw-43h8-f8p3 |
- xmp_toolkit (crates.io) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-66fw-43h8-f8p3
Remediation
- Fix · GHSA-66fw-43h8-f8p3 xmp_toolkit (crates.io) Fixed in 1.9.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-66fw-43h8-f8p3
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences