Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 22 September 2026.

Which products and versions are affected?

stack-graphs (crates.io) SEMVER:introduced=0.0.3-0; GitHub Stack-Graphs 0.0.3 through 0.14.1.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run stack-graphs (crates.io) or GitHub Stack-Graphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

stack-graphs C API memory safety violation in extern functions

Severity: info · Published 2026-09-22

stack-graphs is a Rust library that provides a C API for code analysis. Safe Rust code can directly call unsafe C-compatible functions that accept pointers, including functions that free memory or dereference pointers without validation. Passing a null pointer to memory-deallocation functions or invalid pointers to accessor functions causes immediate undefined behavior, which could lead to crashes or memory corruption.

Vendors: crates.io, GitHub.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 22 September 2026.
Which products and versions are affected?: stack-graphs (crates.io) SEMVER:introduced=0.0.3-0; GitHub Stack-Graphs 0.0.3 through 0.14.1.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run stack-graphs (crates.io) or GitHub Stack-Graphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The stack_graphs::c module exports pointer-taking functions as safe pub extern "C" fn rather than unsafe extern "C" fn, violating Rust's soundness guarantees. Functions like sg_stack_graph_free call Box::from_raw without null-pointer checks, and other pointer-taking functions dereference caller-supplied pointers directly. The vulnerability affects all pointer-taking exports in src/c.rs and can be triggered by any caller with access to the C API. No patched version exists; the upstream repository is archived.

Affected products

GitHub stack-graphs 0.0.3 through 0.14.1

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.