https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T15:48:37.122991+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-26951 CVE-2021-26951 2026-10-25T15:48:37.125201+00:00

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.

 https://cve.radiocsirt.org/vuln/rustsec-2021-0015 RUSTSEC-2021-0015 — `Sectors::get` accesses unclaimed/uninitialized memory 2026-10-25T15:48:37.125262+00:00

Affected: crates.io: calamine

Affected versions of this crate arbitrarily calls `Vec::set_len` to increase length of a vector without claiming more memory for the vector. Affected versions of this crate also calls user-provided `Read` on the uninitialized memory of the vector that was extended with `Vec::set_len`.

This can overwrite active entities in adjacent heap memory and seems to be a major security issue. Also, calling user-provided `Read` on uninitialized memory is defined as UB in Rust.