Executive brief
yara-x is a Rust library for compiling and scanning files against YARA malware detection rules. The `Rules::deserialize` function accepts untrusted binary data without validation, allowing specially crafted payloads to corrupt internal lookup tables. Exploitation can cause memory corruption, undefined behavior, and application crashes when scanning files, potentially enabling denial of service or code execution attacks against security tools relying on yara-x.
Technical details
The vulnerability is a deserialization validation failure in yara-x's `Rules::deserialize` function, which uses `bincode` to directly restore compiled rule structures from untrusted binary input without verifying structural invariants. The deserialized `Rules` struct contains internal lookup tables (`sub_patterns`, `atoms`, `lit_pool`) that subsequent safe operations assume are valid; however, malformed input can violate these invariants. Subsequent safe API calls like `Rules::get_sub_pattern` and `Scanner::scan` contain `unsafe` code blocks that call `get_unchecked()` and `to_str_unchecked()` on these tables without bounds or UTF-8 validation, causing out-of-bounds memory reads and invalid `&str` construction. An attacker can mutate as little as a single byte in serialized metadata (e.g., changing a `SubPatternId` field) to trigger segfaults or undefined behavior when the corrupted rules are scanned. The fix requires either marking `Rules::deserialize` as `pub unsafe fn` with documented preconditions, or replacing all unchecked operations with safe alternatives (`.get()` and `std::str::from_utf8`).
Affected products
- VirusTotal yara-x 1.17.0 and possibly earlier
Timeline
- 2026-09-24: disclosed: Advisory GHSA-2jx3-ff3v-j7jj published