RUSTSEC-2018-0004: Malicious input could cause uninitialized memory to be exposed

What to do

1. See which version you have: cargo tree -i claxon (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p claxon. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example claxon = "0.4.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed.

This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream.

The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.

References

• Package: crates.io/crates/claxon
• Advisory: rustsec.org/advisories/RUSTSEC-2018-0004.html
• Web: github.com/ruuda/claxon/commit/8f28ec275e412dd3af4f3cda460605512faf332c

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.