---
id: RUSTSEC-2025-0167
title: '`Bitmap::try_from(&[u8])` can create invalid values'
summary: '`Bitmap::try_from(&[u8])` can create invalid values'
severity: none
vendor: bitmaps
product: bitmaps
ecosystem: rust
affected:
  - bitmaps >= 3.2.0
published: '2025-12-25'
updated: '2026-08-10'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2025-0167'
references:
  - url: 'https://crates.io/crates/bitmaps'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0167.html'
  - url: 'https://github.com/bodil/bitmaps/issues/35'
tags:
  - osv
  - rust
ingestedAt: '2026-08-11T19:17:10.189Z'
---

## Overview

The `TryFrom<&[u8]>` implementation for `Bitmap<SIZE>` copies the input bytes
into an uninitialized backing store and calls `assume_init()` without
validating that the bytes form a valid value of the backing store type. For
`SIZE = 1` the backing store is a `bool`, so any input byte other than `0x00`
or `0x01` produces an invalid value, which is immediate undefined behavior.

The `AsMut<[u8]>` implementation has the same problem, as it allows safe code
to write invalid bit patterns into the backing store through the returned slice.

No fixed version is available, as the crate is unmaintained; its GitHub
repository was archived by the owner on 2026-05-03.

## Affected packages

- `bitmaps >= 3.2.0`

## Remediation

Refer to the advisory for the patched release.