# OneRingBuf use after free in IntoRef trait

Source: https://junglewise.ai/threats/oneringbuf-use-after-free-in-intoref-trait-a6736ddb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.3 · Published 2026-07-08

OneRingBuf is a Rust library used for managing ring buffers, which are data structures often used for efficient data streaming. A flaw in how the library handles memory allows a program to accidentally use memory after it has been freed. This could lead to unpredictable application behavior, data corruption, or system crashes.

Technologies: [oneringbuf (crates.io)](https://junglewise.ai/threats/technologies/oneringbuf). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.3, published 8 July 2026.

**Which products and versions are affected?** oneringbuf (crates.io) < 0.8.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-08: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run oneringbuf (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in oneringbuf versions prior to 0.8.0. The library exposed the obsolete 'IntoRef::into_ref' method, which returns a 'DroppableRef' handle for heap-backed ring buffers. This handle uses a raw pointer and a manual reference counter ('alive_iters'). However, the 'Clone' implementation for 'DroppableRef' fails to increment this counter. Consequently, when one clone is dropped, it may trigger a 'Box::from_raw' call that frees the underlying allocation while other clones still exist. Subsequent access or dropping of the remaining clones results in a heap-use-after-free. The vulnerability is reachable via safe Rust code and was fixed in version 0.8.0 by removing the 'into_ref' method.

## Affected products

- Skilvingr oneringbuf < 0.8.0

## Timeline

- 2026-05-27: other: Reported
- 2026-06-01: advisory: RustSec advisory issued
- 2026-07-08: disclosed: GitHub Advisory published
- 2026-07-08: patched: Version 0.8.0 released

## References

- [https://github.com/skilvingr/rust-oneringbuf/commit/643a24b30914068416dff9021a069c12c865a316](https://github.com/skilvingr/rust-oneringbuf/commit/643a24b30914068416dff9021a069c12c865a316)
- [https://rustsec.org/advisories/RUSTSEC-2026-0152.html](https://rustsec.org/advisories/RUSTSEC-2026-0152.html)

## Related threats

- [RUSTSEC-2026-0152 - Use-after-free](https://junglewise.ai/threats/rustsec-2026-0152-use-after-free-a195aa73)
- [RUSTSEC-2026-0143 - Double-free in `vmem` storage reachable from safe Rust](https://junglewise.ai/threats/rustsec-2026-0143-double-free-in-vmem-storage-reachable-from-safe-rust-e4e09606)