CVE-2018-20992 is a medium-severity (CVSS 6.5) CWE-908 vulnerability in claxon. A fix is available for claxon — see the affected versions and patch details below.
Uninitialized memory exposure in claxon
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2018-20992 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
claxon🦀claxonReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed.
This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream.
The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | claxon | ≥ 0.4.0&&< 0.4.1 | 0.4.1cargo update -p claxon --precise 0.4.1 |
| 🦀crates.io | claxon | all versions | 0.3.2cargo update -p claxon --precise 0.3.2 |
Affected Products
claxonclaxon_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for claxon, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update claxon to 0.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2018-20992 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2018-20992 in your dependencies?
Find it across crates.io, including transitive dependencies.