Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42199Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

Medium 6.2

In plain English

A medium-severity integer overflow in grid from becheran. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.

Affected products (as reported)

Vendor	Product	Versions
becheran	grid	>= 0.17.0, < 1.0.1

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp x_refsource_CONFIRM
https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072 x_refsource_MISC
https://github.com/becheran/grid/releases/tag/v1.0.1 x_refsource_MISC