Every CVESearch/Get API key

GHSA-vfvv-c25p-m7mm

rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

6.9 MediumFix available

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call drop_in_place on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the already-freed elements:

  • InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped.
  • SerVec::clear() is called again by SerVec::with_capacity() after the user closure returns.

Technical Impact

  • CWE-415 (Double Free): Heap corruption when element type holds Box<T>
  • CWE-416 (Use-After-Free): Memory corruption when element reads from heap during Drop

Both vulnerabilities are triggerable entirely from safe Rust via std::panic::catch_unwind and require no special privileges.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

What each source reports

GitHub Advisories Score used6.9

rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call drop_in_place on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the already-freed elements:

  • InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped.
  • SerVec::clear() is called again by SerVec::with_capacity() after the user closure returns.

Technical Impact

  • CWE-415 (Double Free): Heap corruption when element type holds Box<T>
  • CWE-416 (Use-After-Free): Memory corruption when element reads from heap during Drop

Both vulnerabilities are triggerable entirely from safe Rust via std::panic::catch_unwind and require no special privileges.

Record
GHSA-vfvv-c25p-m7mm
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-415, CWE-416
Updated
2026-11-02
OSV6.9

rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call drop_in_place on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the already-freed elements:

  • InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped.
  • SerVec::clear() is called again by SerVec::with_capacity() after the user closure returns.

Technical Impact

  • CWE-415 (Double Free): Heap corruption when element type holds Box<T>
  • CWE-416 (Use-After-Free): Memory corruption when element reads from heap during Drop

Both vulnerabilities are triggerable entirely from safe Rust via std::panic::catch_unwind and require no special privileges.

Record
GHSA-vfvv-c25p-m7mm
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-415, CWE-416
Updated
2026-11-02
OSVRUSTSEC-2026-0122No score

Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call drop_in_place on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the already-freed elements:

  • InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped.
  • SerVec::clear() is called again by SerVec::with_capacity() after the user closure returns.

Impact

  • CWE-415 (Double Free): heap corruption when the element type is one that owns memory, such as Box<T> or Vec<T>
  • CWE-416 (Use-After-Free): memory corruption when an element is accessed following a caught panic

Both types of undefined behavior can be invoked in safe Rust, but only if unwinding panics are enabled and std::panic::catch_unwind is used.

Record
RUSTSEC-2026-0122
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
rkyv
crates.io
0.8.0 up to 0.8.16
0.8.16

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-vfvv-c25p-m7mm is a medium vulnerability (CVSS 6.9) in rkyv, published April 23, 2026. No source lists public exploit code. Fixed in rkyv 0.8.16.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open