FUSE-Rust: Uninitalized memory read and leak caused by fuser crate
Priority LOW 38CWE-908Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so.
Why it matters now
Fix Fixed fuser (crates.io): 0.16.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | fuser (crates.io) | before 0.16.0 | 0.16.0 | Patch available | GHSA-cvmj-47v9-35m9 |
- fuser (crates.io) Vendor— Affected before 0.16.0 Fixed in 0.16.0 Patch available GHSA-cvmj-47v9-35m9
Remediation
- Fix · GHSA-cvmj-47v9-35m9 fuser (crates.io) Fixed in 0.16.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-cvmj-47v9-35m9
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences