{"id":"RUSTSEC-2026-0282","aliases":[],"status":"published","title":"Double free in `AlignedBox\u003c[T]\u003e::realloc_with_default` when an element's `Drop` panics","description":"Shrinking an `AlignedBox\u003c[T]\u003e` takes ownership of the buffer out of\n`self.container` with `ManuallyDrop::take`, destroys the elements past the new\nlength, and only then commits the new `Box` back into `self.container`.\n`ManuallyDrop::take` moves ownership but not the bits, so until that commit\n`self.container` still points at the original buffer.\n\n`T::drop` runs inside the destruction loop and is user code — `T` carries no\nbound that would exclude a panicking `Drop`. If it unwinds, the commit is\nskipped and `self.container` is left pointing at the buffer whose tail has\nalready been destroyed. `AlignedBox`'s own destructor then reconstructs a `Box`\nfrom that pointer, drops every element again and deallocates — a double free\n(CWE-415) / use-after-free (CWE-416) reachable from safe Rust.\n\nGrowing the slice destroys nothing and is unaffected, as is\n`realloc_with_value`, which requires `T: Copy` and therefore a `Drop` that\ncannot run.\n\n## Mitigation\n\nUpdate to 0.3.1.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-09T12:00:00Z","modified":"2026-09-09T11:00:05Z","fixes":[{"ecosystem":"crates.io","package":"aligned_box","fixed_in":["0.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"aligned_box","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.1"}]}]}],"references":[{"url":"https://crates.io/crates/aligned_box","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0282.html","tags":["advisory"]},{"url":"https://github.com/michaellass/aligned_box/pull/6","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0282","title":"Double free in `AlignedBox\u003c[T]\u003e::realloc_with_default` when an element's `Drop` panics","description":"Shrinking an `AlignedBox\u003c[T]\u003e` takes ownership of the buffer out of\n`self.container` with `ManuallyDrop::take`, destroys the elements past the new\nlength, and only then commits the new `Box` back into `self.container`.\n`ManuallyDrop::take` moves ownership but not the bits, so until that commit\n`self.container` still points at the original buffer.\n\n`T::drop` runs inside the destruction loop and is user code — `T` carries no\nbound that would exclude a panicking `Drop`. If it unwinds, the commit is\nskipped and `self.container` is left pointing at the buffer whose tail has\nalready been destroyed. `AlignedBox`'s own destructor then reconstructs a `Box`\nfrom that pointer, drops every element again and deallocates — a double free\n(CWE-415) / use-after-free (CWE-416) reachable from safe Rust.\n\nGrowing the slice destroys nothing and is unaffected, as is\n`realloc_with_value`, which requires `T: Copy` and therefore a `Drop` that\ncannot run.\n\n## Mitigation\n\nUpdate to 0.3.1.","status":"published","published":"2026-09-09T12:00:00Z","modified":"2026-09-09T11:00:05.081134157Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}