{"id":"GHSA-h5j3-crg5-8jqm","aliases":["RUSTSEC-2025-0106"],"url":"https://o3.security/vulnerability/GHSA-h5j3-crg5-8jqm","summary":"orx-pinned-vec has undefined behavior in index_of_ptr with empty slices","details":"The safe function `index_of_ptr` causes undefined behavior when called with an empty slice.\n\nThe issue occurs in the line `ptr.add(slice.len() - 1)` which underflows when `slice.len()` is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.","published":"2025-10-21T21:54:27Z","modified":"2025-10-28T06:29:24.973717Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"orx-pinned-vec","fixedVersion":"3.21.0"}],"fix":{"url":"https://github.com/orxfun/orx-pinned-vec/pull/53","label":"orxfun/orx-pinned-vec#53"},"references":[{"type":"WEB","url":"https://github.com/orxfun/orx-pinned-vec/issues/52"},{"type":"WEB","url":"https://github.com/orxfun/orx-pinned-vec/pull/53"},{"type":"WEB","url":"https://github.com/orxfun/orx-pinned-vec/commit/4a4007a1aaff25cd417853c76163883a7110e276"},{"type":"PACKAGE","url":"https://github.com/orxfun/orx-pinned-vec"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0106.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-28T06:29:24.973717Z"}}