{"id":"RUSTSEC-2026-0128","aliases":[],"status":"published","title":"Double-free and use-after-free in `Keys::next()`","description":"`Keys::next()` uses `ptr::read` to move out the `Option\u003cV\u003e` by value, which\ndrops the contained `V` when `V` is non-Copy (e.g. `String`). This leaves a\ndangling value in the map's storage slot. Subsequent `get()` operations on\nthat key return a dangling reference to already-freed memory.\n\nThis can be triggered through safe public APIs — `Map::keys()`,\n`Keys::next()`, and `Map::get()` — with no `unsafe` required from the\ncaller. Under Miri, accessing the freed slot produces \"Undefined Behavior:\npointer not dereferenceable: alloc has been freed, so this pointer is\ndangling\".","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-05-02T12:00:00Z","modified":"2026-05-13T12:30:06Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"emap","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/emap","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0128.html","tags":["advisory"]},{"url":"https://github.com/yegor256/emap/issues/168","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0128","title":"Double-free and use-after-free in `Keys::next()`","description":"`Keys::next()` uses `ptr::read` to move out the `Option\u003cV\u003e` by value, which\ndrops the contained `V` when `V` is non-Copy (e.g. `String`). This leaves a\ndangling value in the map's storage slot. Subsequent `get()` operations on\nthat key return a dangling reference to already-freed memory.\n\nThis can be triggered through safe public APIs — `Map::keys()`,\n`Keys::next()`, and `Map::get()` — with no `unsafe` required from the\ncaller. Under Miri, accessing the freed slot produces \"Undefined Behavior:\npointer not dereferenceable: alloc has been freed, so this pointer is\ndangling\".","status":"published","published":"2026-05-02T12:00:00Z","modified":"2026-05-13T12:30:06.615206Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}