CVE-2026-92612
Received Received - Intake

Static String UTF-8 Validation Bypass in Eclipse iceoryx2

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Eclipse Foundation

Description
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-92612
EUVD
EUVD-2026-83882

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
eclipse iceoryx2 From 0.8.0 (exc)
eclipse iceoryx2-bb-container to 0.10.0 (exc)
eclipse iceoryx2 0.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse iceoryx2 versions greater than v0.8.0. The StaticString type exposes its contents as mutable bytes through safe APIs. The String::as_str() method converts these bytes into a Rust string slice without validating UTF-8, allowing creation of invalid &str values. This triggers undefined behavior using safe Rust code due to unsound UTF-8 String trait implementation.

Detection Guidance

This vulnerability affects Eclipse iceoryx2 versions greater than v0.8.0 and is specific to Rust applications using the StaticString API. Detection requires checking the version of iceoryx2 in use. Run: cargo tree -p iceoryx2 or cargo list --package iceoryx2 to verify the installed version.

Impact Analysis

The vulnerability could lead to undefined behavior in applications using affected iceoryx2 versions. This may cause string data corruption, affecting application integrity and availability. Exploitation requires high privileges and specific conditions, making it difficult to trigger in practice. The impact is limited to Rust applications using the vulnerable API directly.

Compliance Impact

This vulnerability primarily impacts memory safety and application integrity due to unsound UTF-8 handling in Rust, which could lead to undefined behavior. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-severity technical flaw requiring high privileges to exploit. Compliance risks would only arise if this flaw enabled data corruption or unauthorized access in systems handling sensitive data.

Mitigation Strategies

Upgrade to iceoryx2 version 0.10.0 or later, which removes the vulnerable API methods. If using iceoryx2-bb-container, ensure it is updated to version 0.10.0 or higher. No backporting is planned for earlier versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart