{"action":"Upgrade yara-x to 1.19.0 or later.","affected":[{"fixed":"1.19.0","introduced":"0"}],"component":"yara-x","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["1.19.0"],"ghsa_id":"GHSA-2jx3-ff3v-j7jj","id":"tcs_01M5KERE62VG84EM3FRAK2M8QJ","modified_at":"2026-09-24T19:15:05.684638950Z","published_at":"2026-09-24T19:09:28Z","references":["https://osv.dev/vulnerability/GHSA-2jx3-ff3v-j7jj","https://github.com/VirusTotal/yara-x/security/advisories/GHSA-2jx3-ff3v-j7jj","https://github.com/VirusTotal/yara-x/commit/25efa375572efcfbe880a263ee3b0932d4b61a24","https://github.com/VirusTotal/yara-x","https://github.com/VirusTotal/yara-x/releases/tag/v1.19.0"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-2jx3-ff3v-j7jj","url":"https://osv.dev/vulnerability/GHSA-2jx3-ff3v-j7jj"}],"summary":"yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB"}