RUSTSEC-2026-0233
Crafted archives can cause a use-after-free during deserialization
Insufficient archive range validation could allow a crafted archive to reach
ArchivedString::deserialize with an invalid pointer. A reported reproducer
used rkyv::from_bytes to deserialize a struct containing strings, a vector,
a box, and an optional hash map. AddressSanitizer detected a heap use-after-free
during string deserialization.
The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.
What each source reports
OSV No score
Crafted archives can cause a use-after-free during deserialization
Insufficient archive range validation could allow a crafted archive to reach
ArchivedString::deserialize with an invalid pointer. A reported reproducer
used rkyv::from_bytes to deserialize a struct containing strings, a vector,
a box, and an optional hash map. AddressSanitizer detected a heap use-after-free
during string deserialization.
The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.
- Record
RUSTSEC-2026-0233- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rkyvcrates.io |
0.8.0-rc.1 up to 0.8.17 | 0.8.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0233 is a vulnerability with no CVSS score yet in rkyv, published May 11, 2026. No source lists public exploit code. Fixed in rkyv 0.8.17.