RUSTSEC-2026-0186: Unchecked pointer offset in crate `memmap2`

What to do

1. See which version you have: cargo tree -i memmap2 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p memmap2. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example memmap2 = "0.9.11") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of Mmap::[unchecked_]advise_range(), MmapMut::[unchecked_]advise_ranage() and MmapMut::flush[_async]_range().

This can cause undefined behavior due to invalid values being passed to pointer::offset() and pointer::add() when passing an out-of-bounds range to any of the affected functions.

The flaw was corrected in commit [cee7cf0] and released in version 0.9.11.

The invalid pointer is not dereferenced, but it is passed to the madvise and msync syscalls and their Windows equivalents.

[cee7cf0] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c

References

• Package: crates.io/crates/memmap2
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0186.html
• Report: github.com/RazrFalcon/memmap2-rs/issues/169
• Web: github.com/RazrFalcon/memmap2-rs/pull/170

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.