Heap-based Buffer Overflow Affecting scratchpad package, versions >=0.0.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Heap-based Buffer Overflow vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-SCRATCHPAD-11953830
- published17 Aug 2025
- disclosed14 Aug 2025
- creditUnknown
Introduced: 14 Aug 2025
CVE NOT AVAILABLE CWE-122 (opens in a new tab)How to fix?
There is no fixed version for scratchpad.
Overview
scratchpad is a create providing a stack-like memory allocator with double-ended allocation support.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the get and set functions in the Tracking trait. An attacker can achieve arbitrary memory access or cause a heap buffer overflow by providing a custom implementation that results in ill-formed raw pointers, which may later be dereferenced within safe APIs.