CVE-2026-92612
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.
- Published Sep 21, 2026
- CVSS 1.0 low
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available