RUSTSEC-2025-0107: Uninitialized memory exposure in any_as_u8_slice

What to do

1. See which version you have: cargo tree -i borrowck_sacrifices (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p borrowck_sacrifices. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example borrowck_sacrifices = "0.2.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The safe function any_as_u8_slice can create byte slices that reference uninitialized memory when used with types containing padding bytes.

The function uses slice::from_raw_parts to create a &[u8] covering the entire size of a type, including padding bytes. According to Rust's documentation, from_raw_parts requires all bytes to be properly initialized, but padding bytes in structs are not guaranteed to be initialized. This violates the safety contract and causes undefined behavior.

References

• Package: crates.io/crates/borrowck_sacrifices
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0107.html
• Report: github.com/alexpyattaev/borrowck_sacrifices/issues/1

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.