UnsoundRUSTSEC-2026-0197 · cgmath
RUSTSEC-2026-0197: `Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices
Short answercgmath has an API that can cause undefined behaviour from safe code: `Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices. No fixed version yet.
| Crate | cgmath |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-03-11 |
| Last changed | 2026-07-03 |
| Also known as | none |
| Affected functions | cgmath::Matrix2::swap_columns, cgmath::Matrix3::swap_columns, cgmath::Matrix4::swap_columns |
What to do
- Find who pulls it in:
cargo tree -i cgmath. - Avoid the affected API (
cgmath::Matrix2::swap_columns,cgmath::Matrix3::swap_columns,cgmath::Matrix4::swap_columns), or replace the crate.
Details from the advisory
The Matrix2::swap_columns, Matrix3::swap_columns, and Matrix4::swap_columns implementations call ptr::swap(&mut self[a], &mut self[b]).
When a == b, these safe APIs create two mutable references to the same matrix column and pass them to ptr::swap. This violates Rust's aliasing rules and can trigger undefined behavior. The issue can be reproduced from safe Rust by calling swap_columns with identical column indices, for example m.swap_columns(0, 0).
A minimal fix is to return early when the two column indices are equal before calling ptr::swap.
References
- Package: crates.io/crates/cgmath
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0197.html
- Report: github.com/rustgd/cgmath/issues/565
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for cgmath
Up next
Same cratecgmath: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?