AIKIDO-2025-10654

TL;DR

Affected versions of this package are vulnerable to uninitialized memory read and leak in the fuser crate, specifically when creating a new libfuse session with fuser::Session::new, where the operation list is incorrectly passed as NULL instead of a valid pointer, causing libfuse to read and leak uninitialized memory. An attacker could exploit this by inducing the application to initialize a FUSE session, potentially disclosing sensitive data from heap memory, such as passwords or cryptographic keys, which might facilitate information disclosure or, in combination with other vulnerabilities, lead to code execution.