EUVD-2026-44968Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file processing triggers the bug (AV:L); user must open crafted binary (UI:R); OOB read discloses memory (C:H) with no write or confirmed crash path (I:N/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can perform an out-of-bounds read when the demangler structure is not yet initialized. This issue is fixed in commit 6bf56d3.
AnalysisAI
Out-of-bounds read in rz-libdemangle's Rust v0 demangler leaks process memory when a caller invokes the demangling routine before the internal rust_v0_t structure is properly initialized. All builds of the library prior to commit 6bf56d3 are affected, putting security analysts and reverse engineers who process untrusted Rust binaries through the Rizin framework at risk of memory disclosure. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; the fix is available as an upstream commit but a versioned release is not independently confirmed.
Technical ContextAI
rz-libdemangle (cpe:2.3:a:rizinorg:rz-libdemangle:*:*:*:*:*:*:*:*) is a C library bundled with the Rizin reverse engineering framework that handles symbol demangling for multiple languages. The vulnerable code resides in src/rust/rust_v0.c, which implements demangling of Rust v0-mangled symbol names. CWE-125 (Out-of-Bounds Read) identifies the root cause: the parsing function dereferences members of the rust_v0_t structure - specifically computing pointer arithmetic using v0->symbol and v0->trail - without first verifying that the v0 pointer and the symbol parameter are non-NULL and valid. The PR #83 diff confirms two distinct corrections: (1) a null-guard if (!v0 || !symbol) { return false; } added at function entry to reject uninitialized inputs, and (2) a pointer arithmetic correction replacing v0->symbol with the local symbol parameter in the symbol_size calculation, preventing a separate but related memory access error.
RemediationAI
Upstream fix is available via commit 6bf56d3b32547ae4cb069ccfc2d2b6c7b63a4cb (PR #83: https://github.com/rizinorg/rz-libdemangle/pull/83); a released patched version with a version tag is not independently confirmed from available data, so users should verify their build incorporates this commit or later by checking git history. As a compensating control until a confirmed patched build is obtained, process untrusted or adversarial Rust binaries only within isolated sandboxes such as containers or virtual machines, limiting the blast radius of any memory disclosure to the sandboxed environment rather than the analyst's host. Avoid running Rizin tooling directly on untrusted samples on systems that handle or store sensitive credentials, keys, or proprietary data.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today