Secuno
ENNL
Book demo

CVE-2026-25541

Tokio-rs Bytes vulnerability

7.5 HIGHPublic exploitEPSS 0.61%
  1. Published4 Feb 2026

Description

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Tokio-rs Bytes≥ 1.2.1 < 1.11.1

Remediation

Fixed in
Tokio-rs Bytes≥ 1.11.1

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-768258.4
RestrictedPython is a tool that helps define a subset of the Python language for…
CVE-2026-552008.1
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write…
CVE-2026-83769.8
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before…
CVE-2025-535108.8
A memory corruption vulnerability exists in the PSD Image Decoding functionality of the…
CVE-2025-529308.8
A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the…
CVE-2025-524568.8
A memory corruption vulnerability exists in the WebP Image Decoding functionality of…

Frequently asked

Is CVE-2026-25541 being actively exploited?

CVE-2026-25541 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.61%.

How severe is CVE-2026-25541?

CVE-2026-25541 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.61% probability of exploitation.

Which products are affected by CVE-2026-25541?

Affected products include Tokio-rs Bytes.

How do I fix CVE-2026-25541?

Upgrade affected software to a fixed version, for example Tokio-rs Bytes 1.11.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-25541 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.