# stack-graphs C API memory safety violation in extern functions

Source: https://junglewise.ai/threats/rustsec-2026-0302-stack-graphs-c-api-exports-are-safe-extern-c-3d7bbffa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-09-22

stack-graphs is a Rust library that provides a C API for code analysis. Safe Rust code can directly call unsafe C-compatible functions that accept pointers, including functions that free memory or dereference pointers without validation. Passing a null pointer to memory-deallocation functions or invalid pointers to accessor functions causes immediate undefined behavior, which could lead to crashes or memory corruption.

Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [GitHub](https://junglewise.ai/threats/vendors/github).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** stack-graphs (crates.io) SEMVER:introduced=0.0.3-0; GitHub Stack-Graphs 0.0.3 through 0.14.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run stack-graphs (crates.io) or GitHub Stack-Graphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The stack_graphs::c module exports pointer-taking functions as safe pub extern "C" fn rather than unsafe extern "C" fn, violating Rust's soundness guarantees. Functions like sg_stack_graph_free call Box::from_raw without null-pointer checks, and other pointer-taking functions dereference caller-supplied pointers directly. The vulnerability affects all pointer-taking exports in src/c.rs and can be triggered by any caller with access to the C API. No patched version exists; the upstream repository is archived.

## Affected products

- GitHub stack-graphs 0.0.3 through 0.14.1

## Timeline

- 2026-09-22: disclosed

## References

- [https://crates.io/crates/stack-graphs](https://crates.io/crates/stack-graphs)
- [https://rustsec.org/advisories/RUSTSEC-2026-0302.html](https://rustsec.org/advisories/RUSTSEC-2026-0302.html)

## Related threats

- [stack-graphs library unmaintained and archived](https://junglewise.ai/threats/rustsec-2026-0303-stack-graphs-is-archived-and-unmaintained-22300fa4)