Unsound Memory Management in array-init-cursor Package: RUSTSEC-2025-0019
Summary
RUSTSEC-2025-0019: array-init-cursor in version 0.2.0 and below is unsound when used with types that implement Drop. Affects array-init-cursor versions >= 0.0.0-0, < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The array-init-cursor package is a Rust library designed to facilitate the initialization of arrays with a cursor-like interface. It allows developers to create and manipulate arrays efficiently. However, versions 0.2.0 and below of this package contain a critical vulnerability that can lead to unsound behavior when used with types that implement the Drop trait, potentially causing memory corruption issues.
Vulnerability Detail
The vulnerability arises from the fact that the Drop implementation for types is executed twice when using the cursor provided by the array-init-cursor package. This can lead to unexpected behavior and memory corruption, especially when dealing with non-Copy types. The issue does not affect users who only utilize the package with Copy types, such as u8, or those who depend on it through the planus crate.
How To Fix
Latest published version: 0.2.1 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version, avoid using the array-init-cursor package with types that implement the Drop trait. Instead, consider using only types that are Copy, or explore alternative libraries that do not have this vulnerability.
Conclusion
The array-init-cursor package has a significant vulnerability in versions 0.2.0 and below, which can lead to unsound memory management when used with certain types. It is crucial to update to version 0.2.1 or higher to mitigate this risk. Users should also consider using the Vulert service to monitor for vulnerabilities in their applications.
See every vulnerability recorded for array-init-cursor →
FAQ
The main issue is that it causes the Drop implementation to run twice for types that implement Drop, leading to potential memory corruption.
Versions 0.2.0 and below are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, avoid using the package with types that implement Drop and consider using Copy types instead.
Yes, this vulnerability can lead to unsound memory management and potential application crashes or data corruption.
References
Related vulnerabilities
Recent vulnerabilities recorded for array-init-cursor.
