CVE-2026-42199 Details
Description
Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.
A vulnerability exists in the Grid data structure for Rust, specifically in versions 0.17.0 prior to 1.0.1. The issue arises from an integer overflow in the expand_rows() method, which can disrupt the alignment between the grid's logical dimensions and its underlying storage. Once this internal consistency is violated, the safe API method get() may inadvertently call get_unchecked() with an incorrect index, causing undefined behavior. This vulnerability has been addressed in version 1.0.1.
Users can upgrade to Grid version 1.0.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072 | [email protected] | Source CodeVendor |
| https://github.com/becheran/grid/releases/tag/v1.0.1 | [email protected] | Release NotesVendor |
| https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| becheran grid | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |