CVE-2026-92612

— UNSCOREDpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.

Weaknesses

CWE-749

Public exploit & PoC references

https://github.com/eclipse-iceoryx/iceoryx2/releases/tag/v0.10.0
https://github.com/eclipse-iceoryx/iceoryx2/security/advisories/GHSA-8mq4-3mwq-qvg6
https://github.com/eclipse-iceoryx/iceoryx2/security/advisories/GHSA-8mq4-3mwq-qvg6

References

https://crates.io/crates/iceoryx2-bb-container/0.10.0
https://github.com/eclipse-iceoryx/iceoryx2/releases/tag/v0.10.0
https://github.com/eclipse-iceoryx/iceoryx2/security/advisories/GHSA-8mq4-3mwq-qvg6
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/307
https://github.com/eclipse-iceoryx/iceoryx2/security/advisories/GHSA-8mq4-3mwq-qvg6

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.