Vulnerability-Lookup

CVE-2026-42199 (GCVE-0-2026-42199)

Vulnerability from cvelistv5 – Published: 2026-05-08 21:15 – Updated: 2026-05-11 16:00

Title

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

Summary

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/becheran/grid/security/advisor…	x_refsource_CONFIRM
https://github.com/becheran/grid/commit/be213bd35…	x_refsource_MISC
https://github.com/becheran/grid/releases/tag/v1.0.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
becheran	grid	Affected: >= 0.17.0, < 1.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42199",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T16:00:17.428184Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T16:00:21.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grid",
          "vendor": "becheran",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.17.0, \u003c 1.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid\u2019s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T21:15:16.561Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp"
        },
        {
          "name": "https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072"
        },
        {
          "name": "https://github.com/becheran/grid/releases/tag/v1.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/becheran/grid/releases/tag/v1.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-38c5-483c-4qqp",
        "discovery": "UNKNOWN"
      },
      "title": "Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42199",
    "datePublished": "2026-05-08T21:15:16.561Z",
    "dateReserved": "2026-04-25T05:04:37.027Z",
    "dateUpdated": "2026-05-11T16:00:21.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42199",
      "date": "2026-05-31",
      "epss": "0.00015",
      "percentile": "0.03623"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42199\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-08T22:16:31.547\",\"lastModified\":\"2026-05-13T16:52:48.773\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid\u2019s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/becheran/grid/releases/tag/v1.0.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-190\", \"lang\": \"en\", \"description\": \"CWE-190: Integer Overflow or Wraparound\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 6.2, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp\"}, {\"name\": \"https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072\"}, {\"name\": \"https://github.com/becheran/grid/releases/tag/v1.0.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/becheran/grid/releases/tag/v1.0.1\"}], \"affected\": [{\"vendor\": \"becheran\", \"product\": \"grid\", \"versions\": [{\"version\": \"\u003e= 0.17.0, \u003c 1.0.1\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-08T21:15:16.561Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid\\u2019s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.\"}], \"source\": {\"advisory\": \"GHSA-38c5-483c-4qqp\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42199\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-11T16:00:17.428184Z\"}}}], \"references\": [{\"url\": \"https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-11T16:00:11.305Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42199\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-04-25T05:04:37.027Z\", \"datePublished\": \"2026-05-08T21:15:16.561Z\", \"dateUpdated\": \"2026-05-11T16:00:21.239Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42199

Vulnerability from fkie_nvd - Published: 2026-05-08 22:16 - Updated: 2026-05-13 16:52

Severity

6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072
	security-advisories@github.com	https://github.com/becheran/grid/releases/tag/v1.0.1
	security-advisories@github.com	https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid\u2019s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1."
    }
  ],
  "id": "CVE-2026-42199",
  "lastModified": "2026-05-13T16:52:48.773",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-08T22:16:31.547",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/becheran/grid/releases/tag/v1.0.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-38C5-483C-4QQP

Vulnerability from github – Published: 2026-04-24 15:57 – Updated: 2026-05-13 13:37

Summary

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

Details

Summary

An integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior.

Details

Tested Version: grid = "1.0.0"

expand_rows() computes the new backing length using unchecked arithmetic:

self.data.len() + rows * self.cols

If rows * self.cols or the subsequent addition overflows usize, the result wraps in release builds and self.data may be resized to a length much smaller than logically required.

After that, if the grid is in ColumnMajor order, the function performs in-place rotation using indices derived from:

let total_rows = self.rows + row_added;
let col_idx = i * total_rows;
self.data[col_idx..col_idx + total_rows + i].rotate_right(i);

These computations also rely on the assumption that the backing storage has been resized to the correct length. Once the earlier length computation has wrapped, this assumption no longer holds, so the function may operate on invalid ranges or otherwise enter an inconsistent state.

Finally, the function updates logical metadata with:

self.rows += rows;

As a result, the grid can end up with logical dimensions that no longer match the actual backing storage. Subsequent safe API calls such as get() may then rely on corrupted metadata and reach unsafe internal accesses, resulting in invalid unchecked access and Undefined Behavior.

PoC

#![forbid(unsafe_code)]

use grid::Grid;

fn main() {
    let mut g = Grid::from_vec(vec![1u8, 2u8], 2);

    g.expand_rows(usize::MAX / 2);

    g.get(0, 0); // triggers UB in get_unchecked
}

Impact

Invalid unchecked access (get_unchecked) reached via safe API
Confirmed by Miri (release-mode):

error: Undefined Behavior: `assume` called with `false`
   --> ..../grid-1.0.0/src/lib.rs:527:9
    |
527 |         self.data.get_unchecked(index)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here

Potential crash / denial of service in release-builds (e.g., SIGSEGV, Illegal instruction)
Violates Rust’s safety guarantees despite using only safe code

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "grid"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.17.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T15:57:36Z",
    "nvd_published_at": "2026-05-08T22:16:31Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn integer overflow in `Grid::expand_rows()` can corrupt the relationship between the grid\u2019s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior.\n\n### Details\nTested Version: grid = \"1.0.0\"\n\nexpand_rows() computes the new backing length using unchecked arithmetic:\n\n`self.data.len() + rows * self.cols\n`\n\nIf rows * self.cols or the subsequent addition overflows usize, the result wraps in release builds and self.data may be resized to a length much smaller than logically required.\n\nAfter that, if the grid is in ColumnMajor order, the function performs in-place rotation using indices derived from:\n\n```\nlet total_rows = self.rows + row_added;\nlet col_idx = i * total_rows;\nself.data[col_idx..col_idx + total_rows + i].rotate_right(i);\n```\n\nThese computations also rely on the assumption that the backing storage has been resized to the correct length. Once the earlier length computation has wrapped, this assumption no longer holds, so the function may operate on invalid ranges or otherwise enter an inconsistent state.\n\nFinally, the function updates logical metadata with:\n\n`self.rows += rows;\n`\n\nAs a result, the grid can end up with logical dimensions that no longer match the actual backing storage. Subsequent safe API calls such as get() may then rely on corrupted metadata and reach unsafe internal accesses, resulting in invalid unchecked access and Undefined Behavior.\n\n### PoC\n```rust\n#![forbid(unsafe_code)]\n\nuse grid::Grid;\n\nfn main() {\n    let mut g = Grid::from_vec(vec![1u8, 2u8], 2);\n\n    g.expand_rows(usize::MAX / 2);\n\n    g.get(0, 0); // triggers UB in get_unchecked\n}\n```\n\n### Impact\n- Invalid unchecked access (`get_unchecked`) reached via safe API\n- Confirmed by Miri (release-mode):\n\n```\nerror: Undefined Behavior: `assume` called with `false`\n   --\u003e ..../grid-1.0.0/src/lib.rs:527:9\n    |\n527 |         self.data.get_unchecked(index)\n    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here\n\n```\n- Potential crash / denial of service in release-builds (e.g., SIGSEGV, Illegal instruction)\n- Violates Rust\u2019s safety guarantees despite using only safe code",
  "id": "GHSA-38c5-483c-4qqp",
  "modified": "2026-05-13T13:37:34Z",
  "published": "2026-04-24T15:57:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/becheran/grid"
    },
    {
      "type": "WEB",
      "url": "https://github.com/becheran/grid/releases/tag/v1.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42199 (GCVE-0-2026-42199)

FKIE_CVE-2026-42199

GHSA-38C5-483C-4QQP

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature