CVE-2026-92612: Eclipse iceoryx2 vulnerability
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asstr() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iceoryx2 StaticString (Eclipse iceoryx2)to a version that resolves this vulnerability.Fixed in v0.8.0
Event History
Frequently Asked Questions
Which versions are affected?
The issue affects Eclipse iceoryx2 versions later than v0.8.0. The provided release reference identifies v0.10.0, but the data does not establish the complete fixed-version range.
What does an attacker or triggering application need to do?
The application must use the safe APIs that expose StaticString contents as mutable bytes, write bytes that are not valid UTF-8, and then obtain a string slice through String::as_str(). This can create an invalid Rust &str and trigger undefined behavior without unsafe Rust code.
Is this limited to applications using unsafe Rust?
No. The described condition can be reached entirely through safe Rust APIs.