CVE-2025-47735 is a low severity race condition (CVSS 2.9) in the wgp crate for Rust, through version 0.2.0. The drop code in inner.rs lacks thread synchronization. No fixed version is confirmed in the record, so check the project issue before you decide whether to keep the crate.
What's affected
The record says the wgp crate through 0.2.0 is affected. It describes the problem as inner::drop in inner.rs lacking drop_slow thread synchronization. The references are the crates.io page and a GitHub issue titled Unsound issue in inner::drop.
The vector is local with high attack complexity, no privileges and no user interaction. Only integrity is affected, and only at a low level. That is why the score is 2.9.
I could not confirm a patched version. The crate page and the issue are the places to check.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find out whether the crate is anywhere in your dependency tree, including indirect use. In a Rust project, run:
cargo tree -i wgp
cargo audit
The first command shows which of your crates depend on wgp. The second checks your lockfile against the RustSec advisory database, which may or may not carry an entry for this CVE. If wgp appears at version 0.2.0 or lower, you are in the affected range.
Also search your own source for direct use. Unsafe code in a small crate only matters if your program calls the affected path.
What to do now
- Run cargo tree -i wgp in each Rust project to see whether the crate is used, directly or indirectly.
- Open the GitHub issue and the crates.io page to see whether a newer version or a fix has been published.
- If a fixed release exists, update the dependency and rebuild.
- If none exists, decide whether you can replace wgp or drop the code path that needs it.
- Review where your code shares the wgp types between threads, since that is where a race condition could matter.
- Add the crate to your watch list so you see future releases.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-362, a race condition. When two threads touch the same data without proper coordination, the outcome depends on timing. In Rust this matters because safe code is supposed to rule out data races. The GitHub issue calls the problem unsound, which in Rust terms means code that is marked safe to use can still cause undefined behavior.
The score is low because the attack is local and hard to trigger. Low does not mean ignore. If your program uses the crate across threads, the timing window could matter, and a reachability check tells you whether the affected code is even called.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version of wgp?
I could not confirm one. Check the crate page and the GitHub issue linked in the record.
Why is the score so low?
The vector is local, needs high complexity and affects only integrity at a low level.
Sources
Last reviewed: 18 October 2026.
