Executive brief
rz-libdemangle is a software library used by the Rizin reverse engineering framework to translate complex computer-generated code names back into human-readable formats. A flaw in how it handles Rust-based code names could allow an attacker to read sensitive information from the computer's memory. This occurs when the library attempts to process a specially crafted code name before it has been properly set up.
Technical details
An out-of-bounds read vulnerability exists in rz-libdemangle's Rust v0 demangler implementation within `src/rust/rust_v0.c`. The root cause is a 'use before assign' flaw where `v0->symbol` is accessed in `rust_v0_init` before it has been initialized, leading to an invalid pointer subtraction when calculating `symbol_size`. An attacker can exploit this by providing a specially crafted symbol for demangling, potentially leading to information disclosure from the process memory. The vulnerability requires local access and user interaction (e.g., a user opening a malicious binary in a tool using the library). The issue was addressed in commit 6bf56d3 by ensuring the correct symbol pointer is used and adding NULL checks.
Affected products
- rizinorg rz-libdemangle < 6bf56d32b32547ae4cb069ccfc2d2b6c7b63a4cb
Timeline
- 2026-05-11: patched: Fix merged in GitHub pull request #83
- 2026-05-13: advisory: GitHub Security Advisory GHSA-4p92-mfjf-qvrc published
- 2026-07-16: disclosed: CVE-2026-45612 published to NVD