[advisory]
id = "RUSTSEC-0000-0000"
package = "aeron"
date = "2026-05-02"
url = "https://github.com/UnitedTraders/aeron-rs/issues/31"
informational = "unsound"
categories = ["memory-corruption"]
keywords = ["out-of-bounds", "segfault"]
[versions]
patched = []MemoryMappedFile::atomic_buffer() performs unchecked pointer arithmetic
without validating that the offset + length fits within the mapped file size.
Passing an offset far beyond the file size causes a segmentation fault on
subsequent buffer operations.
This can be triggered through safe public APIs — atomic_buffer() is a safe
method — with no unsafe required from the caller.