This flaw is an integer overflow in the Grid::expand_rows method of the Rust Grid library. The overflow corrupts the relationship between the grid’s logical dimensions and its backing storage, violating an internal invariant. When the safe API get() subsequently uses this corrupted state, it may call get_unchecked() with an invalid index, resulting in undefined behavior that could lead to memory corruption, application crashes, or, if exploitable, arbitrary code execution.

The vulnerable product is the Grid library for Rust, maintained by becheran. Versions from 0.17.0 up to, but not including, 1.0.1 are affected and require upgrading.

The CVSS score is 6.2, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector includes an attacker supplying input that causes Grid::expand_rows to process a large or crafted number of rows, triggering the overflow. Exploration of this vector would require the attacker to run code that exercises the Grid library in an environment where the overflow can occur.