RUSTSEC-2026-0235
Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.8.17- Upgrade rkyv to this version or later
Description
Shared pointer validation keyed already-validated pointees by their address and
type, but did not include pointer metadata. For unsized pointees, an archive
could therefore contain multiple Rc, Arc, or weak pointers that shared a
data address but used different metadata, such as different slice lengths.
Once the first pointer had been validated, later pointers to the same address
skipped pointee validation. The safe checked rkyv::access API could
consequently return a slice with a forged length, allowing safe indexing to
read out of bounds. The same validation bypass was reachable through checked
deserialization with rkyv::from_bytes.
Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| rkyv | >= 0.7.0-pre.2, < 0.8.17 |
0.8.17 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rkyv crates.io → 0.8.17
- cargo
cargo update -p rkyv --precise 0.8.17
References
Advisories
Issue reports
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables | Not rated yet | Also affects rkyv |
| RUSTSEC-2026-0233 Crafted archives can cause a use-after-free during deserialization | Not rated yet | Also affects rkyv |
| GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution | Medium | Also affects rkyv |
| RUSTSEC-2026-0001 Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM | Not rated yet | Also affects rkyv |
| GHSA-w5cr-frph-hw7f Use of uninitialized buffer in rkyv | High | Also affects rkyv |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor