On this page
Microsoft’s FORGE Lab says an AI-driven scanning system found memory-safety problems in Rust’s standard library, including a flaw that had gone unnoticed for about 11 years. The findings were published in a Microsoft Security blog post on November 9 and covered by CSO Online.
Key takeaways
- The bug involves a signal stack issue around
process::exitin the standard library. - A second issue concerns
execwriting to the process environment while holding only a read lock, present since 2021. - Microsoft found no reliable exploitation path in the conditions it examined and rates practical exploitation as unlikely.
- Some fixes were already proposed or under review when the post went live.
What the lab did
The researchers used Hyenas, a research version of Microsoft’s agentic bug-finding system (codename MDASH), to look for places where code that is supposed to be memory-safe can still trigger undefined behaviour. Some of the bugs in the write-up were found with the tool’s help; others came from the researchers’ own analysis.
Why Rust bugs like this are unusual
Rust’s safe subset is designed to prevent memory errors, so flaws in the standard library, which uses unsafe code internally, matter more than most. They can let ordinary-looking safe code cause undefined behaviour. That is why a long-lived bug in such a core library gets attention even when exploitation is hard.
Do not confuse it with another bug
A separate 11-year-old memory-safety bug, tracked as rust-lang issue #164250, was traced back to Rust 1.4 from 2015. That one came from a community report rather than from Microsoft’s AI tooling.
What it means for developers
- Keep toolchains updated so upstream fixes reach your builds.
- Treat AI-assisted auditing as a complement to fuzzing and code review, not a replacement.
- Expect more reports like this as AI agents are pointed at mature codebases, including the Linux kernel, where AI-found bugs have also been reported.
