Every CVE Search/ Get API key

CVE-2021-25900

Buffer overflow in SmallVec::insert_many

9.8 CriticalFix available

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.72%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Record
CVE-2021-25900
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Record
CVE-2021-25900
Updated
2026-11-02
EUVDEUVD-2022-2287 No score

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Record
EUVD-2022-2287
Updated
2026-11-03
GitHub AdvisoriesGHSA-43w2-9j62-hq99 9.8

Buffer overflow in SmallVec::insert_many

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap. This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Record
GHSA-43w2-9j62-hq99
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 9.8

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Record
CVE-2021-25900
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-25900 9.8

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Record
DEBIAN-CVE-2021-25900
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-43w2-9j62-hq99 9.8

Buffer overflow in SmallVec::insert_many

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap. This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Record
GHSA-43w2-9j62-hq99
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVRUSTSEC-2021-0003 9.8

Buffer overflow in SmallVec::insert_many

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.

This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Thank you to Yechan Bae (@Qwaz) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.

Record
RUSTSEC-2021-0003
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-25900 9.8

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Record
UBUNTU-CVE-2021-25900
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0234 No score

Updated librsvg packages fix a security vulnerability

This update patches the vendored smallvec Rust crate in librsvg to fix a security vulnerability:

The Iterator implementation mishandles destructors, leading to a double free (CVE-2021-25900).

Record
MGASA-2021-0234
Updated
2026-11-02
OSVopenSUSE-SU-2021:0634-1 No score

Security update for librsvg

This update for librsvg fixes the following issues:

  • librsvg was updated to 2.46.5:
    • Update dependent crates that had security vulnerabilities: smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2021-25900 (bsc#1183403)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:0634-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11593-1 No score

gdk-pixbuf-loader-rsvg-2.52.2-2.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.52.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11593-1
Updated
2026-11-02
OSVROOT-APP-CARGO-CVE-2021-25900 No score

CVE-2021-25900 in smallvec - Patched by Root

Root has patched CVE-2021-25900 in the smallvec package for Root:Cargo. Multiple fixed versions available.

Record
ROOT-APP-CARGO-CVE-2021-25900
Updated
2026-11-02
OSVSUSE-SU-2021:1408-1 No score

Security update for librsvg

This update for librsvg fixes the following issues:

  • librsvg was updated to 2.46.5:
    • Update dependent crates that had security vulnerabilities: smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2021-25900 (bsc#1183403)
Record
SUSE-SU-2021:1408-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
smallvec
crates.io
 0.6.3 up to 0.6.14
0.6.14
smallvec
crates.io
 1.0.0 up to 1.6.1
1.6.1
rust-smallvec
Debian:12
 before 1.4.2-2
1.4.2-2
rust-smallvec
Debian:13
 before 1.4.2-2
1.4.2-2
rust-smallvec
Debian:14
 before 1.4.2-2
1.4.2-2
librsvg
Mageia:7
 before 2.45.5-3.2.mga7
2.45.5-3.2.mga7
smallvec
Root:Cargo
 before 1.6.0+aikido.1
1.6.0+aikido.1
smallvec
crates.io
 0.6.3 up to 0.6.14, 1.0.0 up to 1.6.1
0.6.141.6.1
librsvg
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 2.46.5-3.3.1
2.46.5-3.3.1
librsvg
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 2.46.5-3.3.1
2.46.5-3.3.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
rust-smallvec
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.6.10-11.1.0-1
 None known
rust-smallvec
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.2-21.7.0-1
 None known
rust-smallvec
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.11.0-11.11.2-1
 None known
rust-smallvec
Ubuntu:25.10
 All versions, plus listed versions
1.13.2-1
 None known
rust-smallvec
Ubuntu:26.10
 All versions, plus listed versions
1.15.1-11.15.2-1
 None known
rust-smallvec
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.13.2-11.15.1-1
 None known
librsvg
openSUSE:Leap 15.2
 before 2.46.5-lp152.2.3.1
2.46.5-lp152.2.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-25900 is a critical vulnerability (CVSS 9.8) in Servo Smallvec, published January 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. Fixed in smallvec 0.6.14.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open