CVE-2026-92612
Description
A flaw was found in Eclipse iceoryx2, specifically within the iceoryx2-bb-container component. The StaticString functionality exposes its contents as mutable bytes through safe programming interfaces. However, the String::as_str() method converts these bytes into a Rust string slice without proper validation of UTF-8 encoding. This oversight allows an application to create an invalid string, which can lead to undefined behavior. This could potentially result in application instability or other unpredictable outcomes, requiring high privileges and user interaction for exploitation.
Statement
This vulnerability is rated as Low impact because exploitation requires local access with elevated privileges and specialized execution paths to manipulate internal byte buffers, resulting in a minimal attack surface. Furthermore, Eclipse iceoryx2 is not included or enabled by default across core Red Hat Enterprise Linux environments. Any risk is limited to custom applications that incorporate the affected container library and handle unvalidated byte data.
Understanding the Weakness (CWE)
Other
Technical Impact: Quality Degradation; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
