What is GHSA-XW5J-GV2G-MJM2?

GHSA-XW5J-GV2G-MJM2 is a medium-severity security vulnerability in cortex-m-rt (rust), affecting versions >= 0.7.0, < 0.7.3. It is fixed in 0.7.3.

Which versions of cortex-m-rt are affected by GHSA-XW5J-GV2G-MJM2?

cortex-m-rt (rust) versions >= 0.7.0, < 0.7.3 is affected.

Is there a fix for GHSA-XW5J-GV2G-MJM2?

Yes. GHSA-XW5J-GV2G-MJM2 is fixed in 0.7.3. Upgrade to this version or later.

Is GHSA-XW5J-GV2G-MJM2 exploitable, and should I be worried?

Whether GHSA-XW5J-GV2G-MJM2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-XW5J-GV2G-MJM2 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-XW5J-GV2G-MJM2 in cortex-m-rt

Q: Which versions of cortex-m-rt are affected by GHSA-XW5J-GV2G-MJM2?

cortex-m-rt (rust) versions >= 0.7.0, < 0.7.3 is affected.

Q: Is there a fix for GHSA-XW5J-GV2G-MJM2?

Yes. GHSA-XW5J-GV2G-MJM2 is fixed in 0.7.3. Upgrade to this version or later.

Q: Is GHSA-XW5J-GV2G-MJM2 exploitable, and should I be worried?

Whether GHSA-XW5J-GV2G-MJM2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-XW5J-GV2G-MJM2 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-XW5J-GV2G-MJM2?

Upgrade cortex-m-rt to 0.7.3 or later.

Summary

Miscompilation in cortex-m-rt 0.7.1 and 0.7.2

Version 0.7.1 of the cortex-m-rt crate introduced a regression causing the stack to NOT be eight-byte aligned prior to calling main (or any other specified entrypoint), violating the stack ABI of AAPCS32, the default ABI used by all Cortex-M targets. This regression is also present in version 0.7.2 of the cortex-m-rt crate.

This regression can cause certain compiler optimizations (which assume the eight-byte alignment) to produce incorrect behavior at runtime. This incorrect behavior has been observed in real-world applications.

It is advised that ALL users of v0.7.1 and v0.7.2 of the cortex-m-rt crate update to the latest version (v0.7.3), AS SOON AS POSSIBLE. Users of v0.7.0 and prior versions of cortex-m-rt are not affected by this regression.

It will be necessary to rebuild all affected firmware binaries, and flash or deploy the new firmware binaries to affected devices.

Impact

Affected versions

cortex-m-rt (>= 0.7.0, < 0.7.3)

Security releases

cortex-m-rt → 0.7.3 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade cortex-m-rt to 0.7.3 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-XW5J-GV2G-MJM2? GHSA-XW5J-GV2G-MJM2 is a medium-severity security vulnerability in cortex-m-rt (rust), affecting versions >= 0.7.0, < 0.7.3. It is fixed in 0.7.3.
Which versions of cortex-m-rt are affected by GHSA-XW5J-GV2G-MJM2? cortex-m-rt (rust) versions >= 0.7.0, < 0.7.3 is affected.
Is there a fix for GHSA-XW5J-GV2G-MJM2? Yes. GHSA-XW5J-GV2G-MJM2 is fixed in 0.7.3. Upgrade to this version or later.
Is GHSA-XW5J-GV2G-MJM2 exploitable, and should I be worried? Whether GHSA-XW5J-GV2G-MJM2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-XW5J-GV2G-MJM2 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-XW5J-GV2G-MJM2? Upgrade cortex-m-rt to 0.7.3 or later.