Affected versions of solana rbpf expose the safe method EbpfVm::invoke function. This method computes an obfuscated VM pointer by casting self to *mut u64 and applying a randomized offset derived from get runtime environment key().

The resulting pointer arithmetic is performed with ptr::offset, which requires the computed pointer to remain within the same allocation. In practice, the randomized offset can move the pointer far outside the allocation containing the EbpfVm, causing undefined behavior before the supplied builtin function is invoked.

The upstream solana rbpf repository is archived, and no patched version of this crate is currently available.

Users should migrate to the maintained solana-sbpf crate. The issue has been fixed there in anza-xyz/sbpf#151.