RUSTSEC-2020-0073: Mutable reference with immutable provenance

What to do

1. See which version you have: cargo tree -i image (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p image. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example image = "0.23.12") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A mutable reference to a struct was constructed by dereferencing a pointer obtained from slice::as_ptr. Instead, slice::as_mut_ptr should have been called on the mutable slice argument. The former performs an implicit reborrow as an immutable shared reference which does not allow writing through the derived pointer.

There is no evidence for miscompilation, exploitable or otherwise, caused by this bug. Further investigation on Zulip suggests that the unoptimized generated LLVM IR does not contain any UB itself, effectively mitigating further effects.

References

• Package: crates.io/crates/image
• Advisory: rustsec.org/advisories/RUSTSEC-2020-0073.html
• Report: github.com/image-rs/image/issues/1357

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for image

• Vulnerability CriticalRUSTSEC-2019-0014 · 2019-08-21Flaw in interface may drop uninitialized instance of arbitrary types

Full security history of image