RUSTSEC-2025-0109: 
Rust vulnerability analysis and mitigation

The binary_vec_io crate contains critical unsound APIs in its implementation, specifically affecting functions that handle buffer operations. The vulnerability was discovered and reported on October 21, 2025, with the issue being confirmed and merged on October 22, 2025. The crate is currently archived and unmaintained (RustSec PR).

The vulnerability affects two main functions: binary_read_to_ref(f: &mut File, p: &mut T, n: usize) and binary_write_from_ref(f: &mut File, p: &T, n: usize). These functions accept a single reference (&T or &mut T) but allow multiplication by n, which can lead to stack buffer overflow when n > 1. The issue stems from improper use of from_raw_parts with incorrect slice size calculations in the unsafe code blocks (RustSec PR).

The vulnerability can lead to stack-based buffer overflow conditions, potentially allowing attackers to manipulate memory beyond intended boundaries. This could result in program crashes or potential arbitrary code execution in systems using the affected functions (RustSec PR).

The crate has been thoroughly deprecated and is no longer maintained. Users are advised to completely cease using any code from this repository and migrate to alternative solutions for binary vector I/O operations (RustSec PR).