CVE-2021-26305: Cdr Project Cdr

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.

Affected products

• Cdr Project Cdr: before 0.2.4 (fixed in 0.2.4)

Published 2021-01-29. Last modified 2026-06-17.