{"id":"CVE-2018-25027","aliases":["RUSTSEC-2018-0021","CVE-2018-25028","GHSA-ghpq-vjxw-ch5w","GHSA-hxjf-h2mh-r6hj","GHSA-jqpv-jm4m-86j9"],"title":"Use-after-free with objects returned by `Stream`'s `get_format_info` and `get_context` methods","summary":"Use-after-free with objects returned by `Stream`'s `get_format_info` and `get_context` methods","severity":"none","vendor":"libpulse-binding","product":"libpulse-binding","ecosystem":"rust","affected":["libpulse-binding >= 0.0.0-0, < 1.2.1"],"patched":["libpulse-binding 1.2.1"],"published":"2018-06-15","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:02.676199383Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2018-0021","references":[{"url":"https://crates.io/crates/libpulse-binding"},{"url":"https://rustsec.org/advisories/RUSTSEC-2018-0021.html"},{"url":"https://github.com/jnqnfe/pulse-binding-rust/commit/e6930e16573f0b6d12d6628ba5de59147d6f9e95"}],"tags":["osv","rust"],"epss":0.01413,"epssPercentile":0.72565,"ingestedAt":"2026-10-13T11:45:30.150Z","slug":"CVE-2018-25027","body":"## Overview\n\nAffected versions contained a pair of use-after-free issues with the objects returned by the `get_format_info` and `get_context` methods of `Stream` objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.\n\n## Affected packages\n\n- `libpulse-binding >= 0.0.0-0, < 1.2.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `libpulse-binding 1.2.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}