CVE-2021-45687

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-27 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.

Affected products

Raw-Cpuid Project Raw-Cpuid: before 9.1.1 — fixed in 9.1.1

How to fix

Upgrade to a fixed version: Raw-Cpuid Project Raw-Cpuid 9.1.1. Check the vendor advisory for mitigations.

References

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.md
https://rustsec.org/advisories/RUSTSEC-2021-0089.html
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.md
https://rustsec.org/advisories/RUSTSEC-2021-0089.html

Get alerted when CVE-2021-45687 or the next vulnerability affects your stack