UnsoundRUSTSEC-2026-0191 · solana_rbpf
RUSTSEC-2026-0191: `EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic
Short answersolana_rbpf has an API that can cause undefined behaviour from safe code: `EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic. No fixed version yet.
| Crate | solana_rbpf |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | From 0.8.0 onward (every version). |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-05-28 |
| Last changed | 2026-06-29 |
| Also known as | none |
| Affected functions | solana_rbpf::vm::EbpfVm::invoke_function |
What to do
- Find who pulls it in:
cargo tree -i solana_rbpf. - Avoid the affected API (
solana_rbpf::vm::EbpfVm::invoke_function), or replace the crate.
Details from the advisory
Affected versions of solana_rbpf expose the safe method EbpfVm::invoke_function. This method computes an obfuscated VM pointer by casting self to *mut u64 and applying a randomized offset derived from get_runtime_environment_key().
The resulting pointer arithmetic is performed with ptr::offset, which requires the computed pointer to remain within the same allocation. In practice, the randomized offset can move the pointer far outside the allocation containing the EbpfVm, causing undefined behavior before the supplied builtin function is invoked.
Unmaintained
The upstream solana_rbpf repository is archived, and no patched version of this crate is currently available.
Users should migrate to the maintained solana-sbpf crate. The issue has been fixed there in anza-xyz/sbpf#151.
References
- Package: crates.io/crates/solana_rbpf
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0191.html
- Web: github.com/solana-labs/rbpf
- Web: github.com/anza-xyz/sbpf/pull/151
- Package: crates.io/crates/solana-sbpf
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for solana_rbpf
Up next
Same cratesolana_rbpf: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?