Microsoft’s FORGE Lab says it found several memory-safety issues in Rust’s standard library using AI-assisted vulnerability research tools, including bugs that can cause undefined behaviour even when applications call only safe Rust APIs. The findings affect Rust’s foundational core and std libraries, which underpin software built with the language.
The researchers used Hyenas, a research version of Microsoft’s codename MDASH system, to investigate the code. Microsoft says its team reproduced the bugs, assessed their potential security impact and worked with Rust maintainers to report and fix them. The issues fall into three broad patterns: unsafe code that assumes operations will not panic, APIs that trust user-provided trait implementations, and code that relies on process-wide state managed by the operating system or C library.
One example involved str::replace accepting a custom Pattern implementation that could produce a string containing invalid UTF-8. Another affected process::exit when called from a child thread, causing cleanup code to unmap the main thread’s alternate signal stack. Rust’s issue tracker now marks the process::exit report as closed, while the separate CommandExt::exec environment issue remains open.
Microsoft said the process::exit bug dated back to 2015. The researchers found no reliable exploitation path under the conditions they tested and assessed practical exploitation as unlikely. The company’s report does not describe in-the-wild exploitation of the newly discussed issues or assign them CVE identifiers.
Microsoft said two of the issues reported by its team were still open when its November 9 report was published. It also stressed that a Rust soundness bug does not automatically make every application using the language vulnerable; the security impact depends on whether software reaches the affected code under the specific conditions involved.
The findings and technical examples are detailed in Microsoft’s FORGE Lab research report.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
