CVE-2021-26305

Name of the Vulnerable Software and Affected Versions cdr crate versions prior to 0.2.4

Description An issue was discovered in Deserializer::read vec in the cdr crate for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness. The Deserializer::read vec() function created an uninitialized buffer and passed it to a user-provided Read implementation, which is defined as undefined behavior in Rust.

Recommendations For versions prior to 0.2.4, update to version 0.2.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Deserializer::read vec() until a patch is available. Restrict access to the Read implementation to minimize the risk of exploitation.