RUSTSEC-2025-0020: 
Rust vulnerability analysis and mitigation

RUSTSEC-2025-0020 affects the PyO3 library, which provides Rust bindings for Python. The vulnerability was discovered in March 2025 and involves a buffer overflow issue where PyString::from_object fails to properly convert Rust strings to C-strings before calling FFI functions, potentially causing out-of-bounds reads (PyO3 Issue).

The vulnerability occurs in the PyString::from_object function when it takes &str parameters and passes them directly to FFI functions that expect C-style null-terminated strings. This improper handling can lead to out-of-bounds memory accesses since the strings are stored in .rdata section without proper null termination (PyO3 Issue).

When exploited, this vulnerability can cause out-of-bounds memory reads and potential program crashes. The issue affects applications using PyO3 for Python-Rust interoperability, particularly when converting between Python strings and Rust strings (PyO3 Issue).

A temporary workaround involves explicitly null-terminating strings passed to PyString::from_object by appending '\0' to the encoding parameters (e.g., using 'utf-8\0' instead of 'utf-8') (PyO3 Issue).