Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

WS-2022-0126

Date: August 19, 2025

array-macro before 2.1.2 did substitute the array length provided by a user at compile-time multiple times. When an impure constant expression is passed as an array length (such as a result of an impure procedural macro), this can result in the initialization of an array with uninitialized types, which in turn can allow an attacker to execute arbitrary code

Language: RUST

Severity Score

Related Resources (8)

https://gitlab.com/KonradBorowski/array-macro/-/commit/d5b63f72090f3809c21ac28f9cfd84f12559bf7d
https://gitlab.com/KonradBorowski/array-macro/-/issues/5
https://rustsec.org/advisories/RUSTSEC-2022-0017.html
https://github.com/rustsec/advisory-db/blob/main/crates/array-macro/RUSTSEC-2022-0017.md
https://crates.io/crates/array-macro
https://github.com/xfix/array-macro
https://github.com/xfix/array-macro/commit/d5b63f72090f3809c21ac28f9cfd84f12559bf7d
https://www.mend.io/vulnerability-database/WS-2022-0126

Severity Score

Weakness Type (CWE)

Use of Uninitialized Variable

CWE-457

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us