Executive brief
rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
Affected products
- crates.io rkyv
Junglewise Threat Intelligence
rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
Severity: medium · CVSS 4 · Published 2026-05-15
Technologies: rkyv (crates.io). Vendors: crates.io.
Related threats
- rkyv memory corruption via panic-safety bugs in clear functions
- RUSTSEC-2026-0235 - Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
- RUSTSEC-2026-0233 - Crafted archives can cause a use-after-free during deserialization
- RUSTSEC-2026-0234 - Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
- RUSTSEC-2026-0122 - Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`