{"id":"GHSA-j8cj-hw74-64jv","aliases":["RUSTSEC-2026-0029"],"status":"published","title":"Hive has Double-free and Use After Free Vulnerabilities","description":"`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free.\n\nAdditionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with `as_handle` easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415","CWE-416"],"published":"2026-02-26T12:00:00Z","modified":"2026-03-01T06:11:19Z","fixes":[{"ecosystem":"crates.io","package":"hivex","fixed_in":["0.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hivex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"last_affected":"0.2.0"},{"fixed":"0.2.1"}]}],"versions":["0.2.0"]},{"source":"osv","ecosystem":"crates.io","package":"hivex","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"0.2.1"}]}],"versions":["0.2.0"]},{"source":"osv","ecosystem":"crates.io","package":"hivex","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.1"}]}]}],"references":[{"url":"https://codeberg.org/1millibyte/toolsnt/commit/f4c7a0d1fc4a08ce40bb76e447a69a6f383a916e","tags":["web"]},{"url":"https://codeberg.org/1millibyte/toolsnt/issues/18","tags":["web"]},{"url":"https://docs.rs/crate/hivex/0.2.1/source","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0029.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j8cj-hw74-64jv"},{"url":"https://docs.rs/crate/hivex","tags":["web"]},{"url":"https://crates.io/crates/hivex","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-j8cj-hw74-64jv","title":"Hive has Double-free and Use After Free Vulnerabilities","description":"`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free.\n\nAdditionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with `as_handle` easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.","status":"published","published":"2026-02-28T02:48:45Z","modified":"2026-02-28T02:48:47Z","cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T14:39:30.031684Z"}],"osv":[{"id":"GHSA-j8cj-hw74-64jv","title":"Hive has Double-free and Use After Free Vulnerabilities","description":"`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free.\n\nAdditionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with `as_handle` easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.","status":"published","published":"2026-02-28T02:48:45Z","modified":"2026-03-01T06:11:19.337988Z","cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"RUSTSEC-2026-0029","title":"Double-free and use-after-free for Hive","description":"`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which,\nat the end of the scope performed `Drop`, therefore triggering double-free.\n\nAdditionally, function `Hive::from_handle` was not marked as unsafe, making it,\nin combination with `as_handle` easy to clone and trigger double-free in safe\ncode or triggering UB when using invalid pointer.","status":"published","published":"2026-02-26T12:00:00Z","modified":"2026-03-01T06:01:36Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}