Critical
rust-rgb — security advisory
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
- Products
- rust-rgb
- Affected versions
- 0.8.11-1, 0.8.36-1, 0.8.50-1, 0.8.52-1, 0.8.53-1
- Fixed versions
- Not specified
- CVEs
- CVE-2020-25016
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:28 UTC · Revision 1
Source evidence
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
osv:UBUNTU-CVE-2020-25016
rust-rgb
Fixed versions: Not specified
rust-rgb
Fixed versions: Not specified
rust-rgb
Fixed versions: Not specified
rust-rgb
Fixed versions: Not specified
rust-rgb
Fixed versions: Not specified
rust-rgb
Fixed versions: Not specified
Complete source record
{
"id": "6773f5eed7eb4b7e86d89fada15d351c621f9a8538e9141553720353c336f368",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-25016",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2020-25016",
"summary": "A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.",
"evidence": "osv:UBUNTU-CVE-2020-25016",
"products": [
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.8.11-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.8.11-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.8.36-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.8.50-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.8.52-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.8.53-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "rust-rgb",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.8.50-1",
"evidence": "/affected/5/versions"
},
{
"value": "0.8.52-1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2020-25016",
"aliases": [
"UBUNTU-CVE-2020-25016"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/ubuntu/rust-rgb?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.8.11-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25016.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "librust-rgb+serde-dev",
"binary_version": "0.8.11-1"
},
{
"binary_name": "librust-rgb-dev",
"binary_version": "0.8.11-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/ubuntu/rust-rgb?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.8.11-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25016.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "librust-rgb+serde-dev",
"binary_version": "0.8.11-1"
},
{
"binary_name": "librust-rgb-dev",
"binary_version": "0.8.11-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/ubuntu/rust-rgb?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.8.36-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25016.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "librust-rgb-dev",
"binary_version": "0.8.36-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/ubuntu/rust-rgb?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.8.50-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25016.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "librust-rgb-dev",
"binary_version": "0.8.50-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/ubuntu/rust-rgb?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.8.52-1",
"0.8.53-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25016.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "librust-rgb-dev",
"binary_version": "0.8.53-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-rgb",
"purl": "pkg:deb/ubuntu/rust-rgb?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.8.50-1",
"0.8.52-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25016.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "librust-rgb-dev",
"binary_version": "0.8.52-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:54.095716966Z",
"provider": "osv",
"upstream": [
"CVE-2020-25016"
],
"references": [
"https://ubuntu.com/security/CVE-2020-25016",
"https://rustsec.org/advisories/RUSTSEC-2020-0029.html",
"https://github.com/kornelski/rust-rgb/issues/35",
"https://www.cve.org/CVERecord?id=CVE-2020-25016"
]
},
"related_cves": [
{
"value": "CVE-2020-25016",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 356513,
"published_at": "2020-08-29T16:15:00+00:00"
}