GHSA-vfvv-c25p-m7mm RUSTSEC-2026-0122

rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

Medium crates.io

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-415 Double Free; CWE-416 Use After Free
Fix: 0.8.16; Upgrade rkyv to this version or later

Description

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call drop_in_place on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the already-freed elements:

InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped.
SerVec::clear() is called again by SerVec::with_capacity() after the user closure returns.

Technical Impact

CWE-415 (Double Free): Heap corruption when element type holds Box<T>
CWE-416 (Use-After-Free): Memory corruption when element reads from heap during Drop

Both vulnerabilities are triggerable entirely from safe Rust via std::panic::catch_unwind and require no special privileges.

Affected versions

crates.io

Package	Vulnerable	Fixed in
rkyv	`>= 0.8.0, < 0.8.16`	`0.8.16`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

rkyv crates.io → `0.8.16`

cargo

cargo update -p rkyv --precise 0.8.16

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-415: Double Free

The product calls free() twice on the same memory address.

How to prevent it

Architecture and Design: Choose a language that provides automatic memory management.
Implementation: Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
Implementation: Use a static analysis tool to find double free instances.

CWE-416: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it

Architecture and Design: Choose a language that provides automatic memory management.
Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

References

Packages

Timeline

Apr 23, 2026 Published
Sep 10, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0235 Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc	Not rated yet	Also affects rkyv
RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables	Not rated yet	Also affects rkyv
RUSTSEC-2026-0233 Crafted archives can cause a use-after-free during deserialization	Not rated yet	Also affects rkyv
RUSTSEC-2026-0001 Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM	Not rated yet	Also affects rkyv
GHSA-w5cr-frph-hw7f Use of uninitialized buffer in rkyv	High	Also affects rkyv
GO-2026-4981 Crash when handling long CNAME response in net	High	Same weakness, CWE-415
CVE-2026-33824 Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.	Critical Known exploited	Same weakness, CWE-415
CVE-2025-62215 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate…	High Known exploited	Same weakness, CWE-415

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor