GHSA-j8cj-hw74-64jv
Hive has Double-free and Use After Free Vulnerabilities
GHSA-j8cj-hw74-64jv is a vulnerability with no CVSS score yet in hivex, published February 26, 2026. No source lists public exploit code. Fixed in hivex 0.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.1hivex +2 more
Description
Drop implementation for Hive did perform free, but so did Hive::close, which, at the end of the scope performed Drop, therefore triggering double-free.
Additionally, function Hive::from_handle was not marked as unsafe, making it, in combination with as_handle easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.
Affected packages
What each source reports
GitHub AdvisoriesNo score
Hive has Double-free and Use After Free Vulnerabilities
Drop implementation for Hive did perform free, but so did Hive::close, which, at the end of the scope performed Drop, therefore triggering double-free.
Additionally, function Hive::from_handle was not marked as unsafe, making it, in combination with as_handle easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.
- Record
GHSA-j8cj-hw74-64jv- Weakness
- CWE-415, CWE-416
- Updated
- 2026-11-02
OSVNo score
Hive has Double-free and Use After Free Vulnerabilities
Drop implementation for Hive did perform free, but so did Hive::close, which, at the end of the scope performed Drop, therefore triggering double-free.
Additionally, function Hive::from_handle was not marked as unsafe, making it, in combination with as_handle easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.
- Record
GHSA-j8cj-hw74-64jv- Weakness
- CWE-415, CWE-416
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0029No score
Double-free and use-after-free for Hive
Drop implementation for Hive did perform free, but so did Hive::close, which,
at the end of the scope performed Drop, therefore triggering double-free.
Additionally, function Hive::from_handle was not marked as unsafe, making it,
in combination with as_handle easy to clone and trigger double-free in safe
code or triggering UB when using invalid pointer.
- Record
RUSTSEC-2026-0029- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.