Executive brief
yara-x is a pattern matching engine used for malware detection and security analysis. The Rules::deserialize function accepts untrusted binary data without validation, allowing an attacker to craft malicious serialized rules that trigger memory safety violations (out-of-bounds reads and invalid UTF-8 access) when the rules are scanned, potentially causing crashes or undefined behavior.
Technical details
The vulnerability exists in the public safe API Rules::deserialize which uses bincode to deserialize structured data containing lookup tables (sub_patterns, atoms, lit_pool) without validating internal invariants. Subsequent safe operations like Rules::get_sub_pattern and Metadata::next use unchecked access (get_unchecked, to_str_unchecked) on this data, assuming it is well-formed. An attacker supplying malformed serialized bytes can cause out-of-bounds memory reads and invalid UTF-8 interpretation in safe code paths (Scanner::new, Scanner::scan), violating Rust's soundness guarantees.
Affected products
- VirusTotal yara-x before 1.19.0
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Fixed in version 1.19.0