CriticalFix available
rust-rgb — security advisory
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
- Products
- rust-rgb
- Affected versions
- Not specified
- Fixed versions
- 0.8.36-1
- CVEs
- CVE-2020-25016
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:08 UTC · Revision 1
Source evidence
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
osv:DEBIAN-CVE-2020-25016
rust-rgb
Fixed versions: 0.8.36-1
rust-rgb
Fixed versions: 0.8.36-1
rust-rgb
Fixed versions: 0.8.36-1
Complete source record
{
"id": "4e5d42353d4712ddb58cee67ab1e990f0c1b780ba36bcfe00f5802d2ae39672d",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-25016",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-25016",
"summary": "A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.",
"evidence": "osv:DEBIAN-CVE-2020-25016",
"products": [
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.8.36-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.8.36-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.8.36-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2020-25016",
"aliases": [
"DEBIAN-CVE-2020-25016"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.36-1"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/debian/rust-rgb?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-25016.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.36-1"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/debian/rust-rgb?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-25016.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.36-1"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/debian/rust-rgb?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-25016.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:01:47.164793782Z",
"provider": "osv",
"upstream": [
"CVE-2020-25016"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-25016"
]
},
"related_cves": [
{
"value": "CVE-2020-25016",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 451836,
"published_at": "2020-08-29T16:15:09.72+00:00"
}