{"id":"RUSTSEC-2026-0218","title":"`Enum` trait allows type confusion when manually implemented","summary":"`Enum` trait allows type confusion when manually implemented","severity":"none","vendor":"enum-map","product":"enum-map","ecosystem":"rust","affected":["enum-map >= 3.0.0-0.gat.0, < 3.1.0"],"patched":["enum-map 3.1.0"],"published":"2026-07-21","updated":"2026-07-28","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0218","references":[{"url":"https://crates.io/crates/enum-map"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0218.html"},{"url":"https://codeberg.org/sugar700/enum-map/src/branch/master/CHANGELOG.md#version-310"},{"url":"https://github.com/rustsec/advisory-db/issues/3060"}],"tags":["osv","rust"],"ingestedAt":"2026-07-29T19:09:38.031Z","slug":"RUSTSEC-2026-0218","body":"## Overview\n\nAffected versions of this crate did not require the element type of the `Array` associated type in the `Enum` trait to match the array's generic parameter `V`.\n\nThis can result in type confusion, and consequently memory corruption, when a manual `Enum` implementation declares an `Array<V>` whose elements are not actually of type `V`:\n\n```rust\nstruct IntentionallyWrong;\n\nimpl Enum for IntentionallyWrong {\n    type Array<V> = [String; 4];\n\n    fn from_usize(_: usize) -> Self {\n        IntentionallyWrong\n    }\n\n    fn into_usize(self) -> usize {\n        0\n    }\n}\n\nenum_map! { IntentionallyWrong => 42 };\n```\n\nThe flaw was corrected in commit [7a8b815432](https://codeberg.org/sugar700/enum-map/commit/7a8b8154323d426415a10accf104cd05c394cda9) by adding a `Value = V` bound to the `Array` type in the `Enum` trait.\n\n## Affected packages\n\n- `enum-map >= 3.0.0-0.gat.0, < 3.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `enum-map 3.1.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}