{"id":"RUSTSEC-2026-0001","aliases":[],"status":"published","title":"Potential Undefined Behaviors in `Arc\u003cT\u003e`/`Rc\u003cT\u003e` impls of `from_value` on OOM","description":"The `SharedPointer::alloc` implementation for `sync::Arc\u003cT\u003e` and `rc::Rc\u003cT\u003e` in `rkyv/src/impls/alloc/rc/atomic.rs` (and `rc.rs`) does not check if the allocator returns a null pointer on OOM (Out of Memory).\n\nThis null pointer can flow through to `SharedPointer::from_value`, which calls `Box::from_raw(ptr)` with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as `rkyv::from_bytes` or `rkyv::deserialize_using`) if an OOM condition occurs during the allocation of the shared pointer.\n\nThe issue is reachable through safe code and violates Rust's safety guarantees.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-01-05T12:00:00Z","modified":"2026-01-06T15:50:23Z","fixes":[{"ecosystem":"crates.io","package":"rkyv","fixed_in":["0.7.46","0.8.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"rkyv","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.46"},{"introduced":"0.8.0"},{"fixed":"0.8.13"}]}]}],"references":[{"url":"https://crates.io/crates/rkyv","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0001.html","tags":["advisory"]},{"url":"https://github.com/rkyv/rkyv/issues/644","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0001","title":"Potential Undefined Behaviors in `Arc\u003cT\u003e`/`Rc\u003cT\u003e` impls of `from_value` on OOM","description":"The `SharedPointer::alloc` implementation for `sync::Arc\u003cT\u003e` and `rc::Rc\u003cT\u003e` in `rkyv/src/impls/alloc/rc/atomic.rs` (and `rc.rs`) does not check if the allocator returns a null pointer on OOM (Out of Memory).\n\nThis null pointer can flow through to `SharedPointer::from_value`, which calls `Box::from_raw(ptr)` with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as `rkyv::from_bytes` or `rkyv::deserialize_using`) if an OOM condition occurs during the allocation of the shared pointer.\n\nThe issue is reachable through safe code and violates Rust's safety guarantees.","status":"published","published":"2026-01-05T12:00:00Z","modified":"2026-01-06T15:50:23.269686Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}