RUSTSEC-2023-0080: Buffer overflow due to integer overflow in `transpose`

What to do

1. See which version you have: cargo tree -i transpose (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p transpose. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example transpose = "0.2.3") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Given the function transpose::transpose:

fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)

The safety check input_width * input_height == output.len() can fail due to input_width * input_height overflowing in such a way that it equals output.len(). As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since * panics on overflow in debug mode.

Exploiting this issue requires the caller to pass input_width and input_height arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.

References

• Package: crates.io/crates/transpose
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0080.html
• Report: github.com/ejmahler/transpose/issues/11

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.