CVE-2018-20998: Memory Corruption in arrayfire
Summary
CVE-2018-20998: Potential memory corruption in arrayfire. Affects arrayfire versions < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Arrayfire is an open-source library that provides a high-level interface for parallel computing with GPUs. It is commonly used for numerical computations and data processing. The vulnerability identified as CVE-2018-20998 affects versions of the arrayfire crate up to 3.5.0 when used with Rust versions 1.28 or later. This vulnerability is related to the attribute repr() added to enums for compatibility with C-FFI, which caused memory corruption on the MSVC toolchain. The issue was fixed in version 3.6.0 of the crate.
Vulnerability Detail
The vulnerability in arrayfire allowed for potential memory corruption due to the improper handling of the repr() attribute on enums. This issue specifically affected the MSVC toolchain and was triggered when using Rust versions 1.28 or later. The memory corruption could lead to various security risks, including crashes, arbitrary code execution, and potential data breaches. It is important to update to version 3.6.0 or later of the arrayfire crate to mitigate this vulnerability.
How To Fix
Latest published version: 3.8.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in arrayfire, identified as CVE-2018-20998, could result in memory corruption and various security risks. It is crucial to update the arrayfire crate to version 3.6.0 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for arrayfire →
FAQ
Arrayfire is an open-source library for parallel computing with GPUs. It provides a high-level interface for numerical computations and data processing.
Versions of the arrayfire crate up to 3.5.0 are affected when used with Rust versions 1.28 or later.
The memory corruption caused by this vulnerability can lead to crashes, arbitrary code execution, and potential data breaches.
To fix this vulnerability, update the arrayfire crate to version 3.6.0 or later in your Rust project.
No specific workaround is mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for arrayfire.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
