{"id":"RUSTSEC-2026-0139","aliases":[],"status":"published","title":"Null-pointer dereference and double-free via safe APIs","description":"Two soundness violations exist in the Rust bindings for MetaCall:\n\n**Null-pointer dereference:** `MetaCallFuture::new_raw()` accepts a raw\npointer without validation. The `Debug` impl calls `Box::from_raw(self.data)`\non it. Passing a null pointer causes the `Debug` impl to construct a\n`NonNull` from null, producing undefined behavior.\n\n**Double-free:** `MetaCallPointer::clone()` shares the same `rust_value` raw\npointer between the clone and the original. Calling `get_value_untyped()` on\nboth clones calls `Box::from_raw` on the same pointer twice, resulting in a\ndouble-free.\n\nBoth issues can be triggered through safe public APIs —\n`MetaCallFuture::new_raw()`, `MetaCallPointer::new()`, `clone()`, and\n`get_value_untyped()` — with no `unsafe` required from the caller.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-05-02T12:00:00Z","modified":"2026-05-13T15:00:15Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"metacall","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/metacall","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0139.html","tags":["advisory"]},{"url":"https://github.com/metacall/core/issues/618","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0139","title":"Null-pointer dereference and double-free via safe APIs","description":"Two soundness violations exist in the Rust bindings for MetaCall:\n\n**Null-pointer dereference:** `MetaCallFuture::new_raw()` accepts a raw\npointer without validation. The `Debug` impl calls `Box::from_raw(self.data)`\non it. Passing a null pointer causes the `Debug` impl to construct a\n`NonNull` from null, producing undefined behavior.\n\n**Double-free:** `MetaCallPointer::clone()` shares the same `rust_value` raw\npointer between the clone and the original. Calling `get_value_untyped()` on\nboth clones calls `Box::from_raw` on the same pointer twice, resulting in a\ndouble-free.\n\nBoth issues can be triggered through safe public APIs —\n`MetaCallFuture::new_raw()`, `MetaCallPointer::new()`, `clone()`, and\n`get_value_untyped()` — with no `unsafe` required from the caller.","status":"published","published":"2026-05-02T12:00:00Z","modified":"2026-05-13T15:00:15.67079Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}