CVE-2026-92612 PUBLISHED

Assigner: eclipse
Reserved: 16.09.2026 Published: 21.09.2026 Updated: 21.09.2026

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS Score: 1

Product Status

Vendor Eclipse Foundation
Product Eclipse iceoryx™
Versions Default: unaffected
  • affected from 0.8.1 to * (incl.)

Credits

  • https://github.com/hudson-oai finder

References

Problem Types

  • CWE-749 CWE