CVE-2026-44983: Servo smallbitvec heap buffer overflow via integer overflow

Executive brief

A vulnerability in the smallbitvec library, which provides space-efficient bit-vector storage for Rust applications, could allow an attacker to cause memory corruption. By providing specific large inputs, an attacker can trigger an internal calculation error that results in the application writing data outside of its intended memory area. This can lead to application crashes or potentially allow unauthorized access to sensitive information.

Technical details

An integer overflow exists in the internal `buffer_len` helper function of the `smallbitvec` crate due to unchecked arithmetic: `(cap + bits_per_storage() - 1) / bits_per_storage()`. When `cap` is near `usize::MAX`, the addition wraps around in release builds, leading to an undersized heap allocation while internal metadata (logical length/capacity) remains large. Subsequent calls to safe APIs like `set`, `push`, or `reserve` use this inconsistent metadata to perform pointer arithmetic, resulting in out-of-bounds memory access and heap buffer overflow. The vulnerability is exploitable via safe Rust code without requiring `unsafe` blocks from the consumer. No patched version is currently available.

Affected products

• servo smallbitvec >= 1.0.1, <= 2.6.0

Timeline

• 2026-05-06: disclosed: Disclosed to servo/smallbitvec
• 2026-05-09: advisory: GitHub Advisory published
• 2026-05-26: other: NVD published CVE-2026-44983

References

• https://api.github.com/users/ksj1230
• https://github.com/ksj1230
• https://api.github.com/users/ksj1230/gists%7B/gist_id%7D
• https://api.github.com/users/ksj1230/repos
• https://avatars.githubusercontent.com/u/38639076?v=4
• https://api.github.com/users/ksj1230/events%7B/privacy%7D