Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🦀
🦀 crates.io🐍 PyPI
Not in CISA KEV
CRITICAL severity

Potential memory corruption in arrayfireGHSA-69fv-gw6g-8ccg

CRITICALFix: arrayfire/arrayfire-rust#177

GHSA-69fv-gw6g-8ccg is a critical-severity (CVSS 9.8) Buffer Overflow vulnerability in arrayfire. A fix is available for arrayfire — see the affected versions and patch details below.

Also known asCVE-2018-20998RUSTSEC-2018-0011
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs76th percentile — riskier than 76% of all scored CVEsHighest risk
0.00%0.72%1.44%2.16%0.4%1.7%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-69fv-gw6g-8ccg by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,386 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
🦀arrayfire🐍arrayfire

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io, PyPI packages — download data is not available via public APIs for these ecosystems.

Description

The attribute repr() added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain.

arrayfire crates <= version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28.

The issue seems to be interlinked with which version of Rust is being used.

The issue was fixed in crate 3.6.0.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.ioarrayfireall versions3.6.0cargo update -p arrayfire --precise 3.6.0
🐍PyPIarrayfireall versions3.6.0pip install --upgrade 'arrayfire==3.6.0'

Affected Products

1 product · 1 configurations
Application
arrayfirearrayfire
< 3.6.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for arrayfire, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update arrayfire to 3.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-69fv-gw6g-8ccg is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

The attribute repr() added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain. arrayfire crates <= version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28. The issue seems to be interlinked with which version of Rust is being used. The issue was fixed in crate 3.6.0.
O3 Security · Impact-Aware SCA

Is GHSA-69fv-gw6g-8ccg in your dependencies?

Find it across crates.io, PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Potential memory corruption in arrayfire (Critical 9.8)