https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T05:17:13.295303+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-28030 CVE-2021-28030 2026-10-15T05:17:13.329599+00:00

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

 https://cve.radiocsirt.org/vuln/rustsec-2021-0029 RUSTSEC-2021-0029 — Tape::take_bytes exposes uninitialized memory to a user-provided Read 2026-10-15T05:17:13.329650+00:00

Affected: crates.io: truetype

Affected versions of this crate passed an unininitialized buffer to a user-provided `Read` instance in `Tape::take_bytes`.

This can result in safe `Read` implementations reading from the uninitialized buffer leading to undefined behavior.

The flaw was corrected in commit `1f2dc7f37dd` by removing the unsafe block and zero-initializing the buffer.