Scientific: Out-of-bounds read
Affects scientificSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.3.10.0
Data as of 3 Nov 2026, 23:43 UTC
What to do
Upgrade scientific to 0.3.10.0.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagescientific | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to scientific version 0.3.10.0 or later, which fixes the integer overflow and out-of-bounds read issues by using Integer arithmetic and adding bounds checks. This upgrade resolves the crash and invalid comparison results. No other mitigation is required.
Description
The scientific library version 0.3.9.0 introduced an out-of-bounds read vulnerability in its Eq and Ord implementations for numbers with extreme exponents. This occurs due to integer overflow in exponent calculations leading to negative indexing of a cached power-of-ten array, causing a segmentation fault (SIGSEGV). The issue affects comparisons and arithmetic operations on Scientific values with very large or small exponents. Version 0.3.10.0 fixes the problem by using Integer for logarithm calculations and adding bounds checks.