The rz-libdemangle library used by rizinorg contains a vulnerability identified as CVE-2026-45612. The Rust demangler implementation in src/rust/rust_v0.c can perform an out-of-bounds read if the demangler structure is accessed before initialization. This is classified as a CWE-125 vulnerability. The issue was addressed in commit 6bf56d3, though no official patch or fixed version is explicitly documented in the provided data.

The vulnerability allows an out-of-bounds read which can lead to disclosure of sensitive memory content (confidentiality impact). There is no indication of integrity or availability impact. The attack vector requires local access with low complexity and user interaction, limiting the scope of exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue is fixed in commit 6bf56d3, so applying this commit or a later official release containing this fix is recommended once available. Until then, avoid using vulnerable versions or restrict access to trusted users only.