6.8

CVE-2026-25727: time_project time Stack-based Buffer Overflow

CVSS: 6.8v4.0MediumAnalyzed
AliasesSUSE-SU-2026:0452-1SUSE-SU-2026:0453-1SUSE-SU-2026:0470-1
Published 06-02-2026Last modified 06-02-2026
Open JSON

Vulnerability summary

CVE-2026-25727 is a medium (CVSS 6.8) Stack-based Buffer Overflow vulnerability in time_project time. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.8% of scored vulnerabilities.

Overall risk
27/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.8/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.34%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 20
OPENSUSE-FU-2026:20453-1OPENSUSE-SU-2026:11656-1OPENSUSE-SU-2026:20364-1OPENSUSE-SU-2026:21689-1OPENSUSE-SU-2026:21782-1OPENSUSE-SU-2026:21982-1

Timeline

  1. 06-02-2026
    PublishedVulnerability first disclosed.
  2. 06-02-2026
    Last modifiedVulnerability information updated.

Description

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

+0.04 pp

From 0.30% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard66 products
  • atuin< 18.11.0-r2
  • bat< 0.26.1-r3
  • berg< 0.5.5-r0
  • buck2< 20260201-r1
  • cargo-audit< 0.22.1-r1
Wolfi49 products
  • atuin< 18.11.0-r2
  • bat< 0.26.1-r3
  • berg< 0.5.5-r0
  • buck2< 20260201-r1
  • cargo-audit< 0.22.1-r1
Suse47 products
  • cargo-auditable&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 0.7.2~0-150300.7.6.1
  • cargo-auditable&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 0.7.2~0-150300.7.6.1
  • cargo-auditable&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 0.7.2~0-150500.12.6.1
  • cargo-auditable&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 0.7.2~0-150500.12.6.1
  • cargo-auditable&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7< 0.7.2~0-150700.3.5.1
Opensuse20 products
  • cargo-auditable&distro=openSUSE Leap 15.6< 0.7.2~0-150500.12.6.1
  • cargo-auditable&distro=openSUSE Tumbleweed< 0.7.2~0-2.1
  • cargo-audit&distro=openSUSE Tumbleweed< 0.22.1~git0.efcde93-2.1
  • cargo-c&distro=openSUSE Tumbleweed< 0.10.15-2.1
  • himmelblau&distro=openSUSE Tumbleweed< 2.3.5+git0.9dd526c-1.1
Crates.Io1 product
  • time≥ 0.3.6, < 0.3.47
Debian1 product
  • rust-time< 0.3.9-1+deb12u1 | < 0.3.37-1+deb13u1 | < 0.3.47-1
Time_project1 product
  • time≥ 0.3.6, < 0.3.47
Time-rs1 product
  • time≥ 0.3.6, < 0.3.47
Ubuntu1 product
  • rust-timeAll versions (No fix recorded)

9 vendors · 187 products

References

47 links
Show all 47 references