RUSTSEC-2023-0045: memoffset allows reading uninitialized memory

What to do

1. See which version you have: cargo tree -i memoffset (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p memoffset. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example memoffset = "0.6.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::size_of<T> may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::align_of. Older implementation prior to it allows using uninitialized data obtained from std::mem::uninitialized with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for "father" that includes (directly or transitively) type that does not allow to be uninitialized.

This flaw was corrected by using std::ptr::addr_of in <https://github.com/Gilnaa/memoffset/pull/50>.

References

• Package: crates.io/crates/memoffset
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0045.html
• Report: github.com/Gilnaa/memoffset/issues/24

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for memoffset

• Unsound HighRUSTSEC-2019-0011 · 2019-07-16Flaw in offset_of and span_of causes SIGILL, drops uninitialized memory of arbitrary type on panic in client code

Full security history of memoffset