AIKIDO-2025-10559

TL;DR

Affected versions of this package are vulnerable to Uninitialized Memory Drop in IdMap::from_iter Constructor. Due to a flaw in id_map::IdMap::from_iter, the constructor may create objects where the values vector has a length smaller than its capacity, while the ids field is initialized using the larger capacity value. When such an IdMap is dropped, its destructor erroneously assumes all values.capacity() elements are initialized and attempts to iterate over and drop them, dereferencing uninitialized memory. This causes undefined behavior (e.g., segmentation faults or heap corruption). An attacker could exploit this by supplying an iterator that yields fewer items than allocated capacity, then triggering the destructor, potentially leading to denial of service via crash or, in some environments, arbitrary code execution by manipulating uninitialized memory layouts.