toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor
Priority LOW 38CWE-122Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
An off-by-one error in the `DrainCol::drop` destructor could cause an unsafe memory copy operation to exceed the bounds of the associated vector. The error was related to the size of the data being copied in one of the `ptr::copy` invocations inside the destructor. When removing the first column from a TooDee object, the DrainCol return object could cause a heap buffer overflow vulnerability when it is dropped. The issue was fixed in commit `e6e16d5` by reducing the copied size by one.
Why it matters now
Fix Fixed toodee (crates.io): 0.6.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | toodee (crates.io) | 0.2.0 to before 0.6.0 | 0.6.0 | Patch available | GHSA-pfp7-vxgr-83pw |
- toodee (crates.io) Vendor— Affected 0.2.0 to before 0.6.0 Fixed in 0.6.0 Patch available GHSA-pfp7-vxgr-83pw
Remediation
- Fix · GHSA-pfp7-vxgr-83pw toodee (crates.io) Fixed in 0.6.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-pfp7-vxgr-83pw
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences