Executive brief
A memory management flaw was found in the thin-vec library, a Rust component used for memory-efficient data storage. If a specific error occurs while the library is cleaning up data, it may attempt to free the same memory twice or access memory that has already been released. This can lead to application crashes or potentially allow an attacker to execute unauthorized code on the system.
Technical details
A double-free and use-after-free (UAF) vulnerability exists in the `IntoIter::drop` and `ThinVec::clear` implementations of the `thin_vec` crate. The root cause is a failure to update the container's length (via `set_len(0)`) if a panic occurs during the sequential deallocation of elements using `ptr::drop_in_place`. During the resulting stack unwinding, the container is dropped again, leading to a second attempt to free already-released memory. This can be exploited to achieve memory corruption or arbitrary code execution, particularly when using `Box<dyn Trait>` types where vtable hijacking is possible. The issue is fixed in version 0.2.16 by implementing a DropGuard pattern or pre-zeroing the length.
Affected products
- Mozilla thin-vec 0.2.15
Timeline
- 2026-04-14: advisory: GitHub Security Advisory published by Mozilla
- 2026-04-20: disclosed: NVD publication date
- 2026-04-20: patched: Version 0.2.16 released