-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wrflib | rust | <= 0.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability advisory explicitly states that all functions under wrflib::byte_extract are vulnerable due to a lack of bounds checking when performing pointer arithmetic. Analysis of the source code for wrflib/main/src/byte_extract.rs confirms this. All functions within this file use unsafe blocks to perform pointer arithmetic (data.as_ptr().add(offset)) without validating that the provided offset is within the bounds of the data slice. This can be exploited by providing a crafted offset that causes the function to read from an arbitrary memory location, leading to a crash or information disclosure. The file's introductory comment even acknowledges the intentional lack of safety for performance reasons. Since the library is unmaintained, no patch is available, and all versions up to and including 0.0.3 are affected.