CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-28030
High (7.5) in truetype project truetype. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in truetype 0.30.1.
An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-908
- Published
- Modified
- Record from
- the NVD, synced
Affected
- truetype_project:truetype
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v7q4-97x4-4qw2 | crates.io | truetype | <0.30.1 | 0.30.1 |
| RUSTSEC-2021-0029 | crates.io | truetype | >=0.0.0-0 <0.30.1 | 0.30.1 |