CVE-2018-20998: Memory Corruption Vulnerability in arrayfire
Summary
CVE-2018-20998: Enum repr causing potential memory corruption. Affects arrayfire versions >= 3.5.1-0, < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Arrayfire is a crate available on crates.io, which provides a high-performance library for numerical computing in Rust. It is commonly used for tasks such as image processing, machine learning, and scientific simulations. The vulnerability discussed here affects versions of arrayfire up to 3.5.0 when used with Rust 1.28 or later. It is specific to the Windows operating system and the x86_64 architecture. The vulnerability is related to the use of the repr() attribute on enums, which is necessary for compatibility with C-FFI. However, this attribute caused memory corruption issues on the MSVC toolchain.
Vulnerability Detail
The memory corruption vulnerability in arrayfire can lead to serious consequences. An attacker could potentially exploit this vulnerability to execute arbitrary code, manipulate data, or cause a denial of service. The issue was fixed in version 3.6.0 of the crate. It is important to note that this vulnerability is specific to the combination of arrayfire and Rust versions mentioned above.
How To Fix
Latest published version: 3.8.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The memory corruption vulnerability in arrayfire can have serious implications for applications using this crate. It is crucial to update to version 3.6.0 or later to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for arrayfire →
FAQ
Arrayfire is a high-performance numerical computing library in Rust, commonly used for tasks such as image processing, machine learning, and scientific simulations.
Versions up to 3.5.0 of the arrayfire crate are affected by this vulnerability.
This vulnerability affects Rust versions 1.28 and later when used with arrayfire versions up to 3.5.0.
The memory corruption vulnerability in arrayfire can allow an attacker to execute arbitrary code, manipulate data, or cause a denial of service.
To fix this vulnerability, update the arrayfire crate to version 3.6.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for arrayfire.
