GHSA-2jx3-ff3v-j7jj: yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

September 24, 2026

[!NOTE] This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification.

References

github.com/VirusTotal/yara-x/commit/25efa375572efcfbe880a263ee3b0932d4b61a24
github.com/VirusTotal/yara-x/releases/tag/v1.19.0
github.com/VirusTotal/yara-x/security/advisories/GHSA-2jx3-ff3v-j7jj
github.com/advisories/GHSA-2jx3-ff3v-j7jj

Code Behaviors & Features

Detect and mitigate GHSA-2jx3-ff3v-j7jj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →