RUSTSEC-2026-0001
Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
The SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).
This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.
The issue is reachable through safe code and violates Rust's safety guarantees.
What each source reports
OSV No score
Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
The SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).
This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.
The issue is reachable through safe code and violates Rust's safety guarantees.
- Record
RUSTSEC-2026-0001- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rkyvcrates.io |
0.0.0-0 up to 0.7.46, 0.8.0 up to 0.8.13 | 0.7.460.8.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0001 is a vulnerability with no CVSS score yet in rkyv, published January 5, 2026. No source lists public exploit code. Fixed in rkyv 0.7.46.