EUVD-2025-4901

Malicious code in bioql PyPI...

GHSA-H7H7-6MX3-R89V Fyrox has unsound usages of `Vec::from_raw_parts`

The library provides a public safe API transmutevecasbytes, which incorrectly assumes that any generic type T could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as T and cast it to u8 pointer. In the issue, we develop a PoC to show...

Fyrox has unsound usages of `Vec::from_raw_parts`

The library provides a public safe API transmutevecasbytes, which incorrectly assumes that any generic type T could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as T and cast it to u8 pointer. In the issue, we develop a PoC to show...

fyrox-animation (=0.2.0), fyrox-graph (=0.1.0) +2 more potentially affected by unknown CVE via fyrox-core (=0.28.1)

fyrox-core CARGO version =0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on fyrox-core and may be impacted: - fyrox-animation =0.2.0 - fyrox-graph =0.1.0 - fyrox-resource =0.12.0 - fyrox-sound =0.35.0 Source cves: unknown CVE Source advisory:...

PT-2025-7252 · Fyrox · Fyrox

Name of the Vulnerable Software and Affected Versions: Fyrox versions prior to the latest version on the master branch Description: The issue arises from the transmute vec as bytes API, which incorrectly assumes that any generic type T has a stable layout. This can lead to uninitialized memory...

cvars-console-fyrox (>=0.1.0 <=0.5.0), fyrox (>=0.24.0 <=0.27.1) +7 more potentially affected by unknown CVE via fyrox-core (>=0.19.0 <=0.28.1)

fyrox-core CARGO version =0.19.0, =0.1.0, =0.24.0, =0.1.0, =0.3.0, =0.26.0, =0.15.0, =0.11.0, =0.12.0, =0.14.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0435...

PT-2024-41060 · Fyrox · Fyrox

Name of the Vulnerable Software and Affected Versions: Fyrox versions prior to the latest version on the master branch Description: The issue arises from the transmute vec as bytes API, which incorrectly assumes that any generic type T has a stable layout. This can lead to uninitialized memory...