RUSTSEC-2026-0139
Null-pointer dereference and double-free via safe APIs
Two soundness violations exist in the Rust bindings for MetaCall:
Null-pointer dereference: MetaCallFuture::new_raw() accepts a raw
pointer without validation. The Debug impl calls Box::from_raw(self.data)
on it. Passing a null pointer causes the Debug impl to construct a
NonNull from null, producing undefined behavior.
Double-free: MetaCallPointer::clone() shares the same rust_value raw
pointer between the clone and the original. Calling get_value_untyped() on
both clones calls Box::from_raw on the same pointer twice, resulting in a
double-free.
Both issues can be triggered through safe public APIs —
MetaCallFuture::new_raw(), MetaCallPointer::new(), clone(), and
get_value_untyped() — with no unsafe required from the caller.
What each source reports
OSV No score
Null-pointer dereference and double-free via safe APIs
Two soundness violations exist in the Rust bindings for MetaCall:
Null-pointer dereference: MetaCallFuture::new_raw() accepts a raw
pointer without validation. The Debug impl calls Box::from_raw(self.data)
on it. Passing a null pointer causes the Debug impl to construct a
NonNull from null, producing undefined behavior.
Double-free: MetaCallPointer::clone() shares the same rust_value raw
pointer between the clone and the original. Calling get_value_untyped() on
both clones calls Box::from_raw on the same pointer twice, resulting in a
double-free.
Both issues can be triggered through safe public APIs —
MetaCallFuture::new_raw(), MetaCallPointer::new(), clone(), and
get_value_untyped() — with no unsafe required from the caller.
- Record
RUSTSEC-2026-0139- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
metacallcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0139 is a vulnerability with no CVSS score yet in metacall, published May 2, 2026. No source lists public exploit code. No source names a fixed version.