Rust advisories / iced-x86
Vulnerability CriticalRUSTSEC-2021-0068 · iced-x86
RUSTSEC-2021-0068: Soundness issue in `iced-x86` versions <= 1.10.3
Short answerA security vulnerability in the iced-x86 crate: Soundness issue in `iced-x86` versions <= 1.10.3. GitHub rates it Critical. Fixed in 1.10.4: update to a fixed version.
| Crate | iced-x86 |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 1.10.4. |
| Fixed in | 1.10.4 |
| Severity | Critical (GitHub rating) |
| Published | 2021-05-19 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2021-38188, GHSA-jjx5-3f36-6927 |
| Affected functions | iced_x86::Decoder::new |
What to do
- See which version you have:
cargo tree -i iced-x86(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p iced-x86. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleiced-x86 = "1.10.4") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Versions of iced-x86 <= 1.10.3 invoke undefined behavior which may cause soundness issues in crates using the iced_x86::Decoder struct. The Decoder::new() function made a call to slice.get_unchecked(slice.length()) to get the end position of the input buffer. The flaw was fixed with safe logic that does not invoke undefined behavior.
More details can be found at <https://github.com/icedland/iced/issues/168>.
References
- Package: crates.io/crates/iced-x86
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0068.html
- Report: github.com/icedland/iced/issues/168
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?