Executive brief
Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
Affected products
- crates.io rkyv
Junglewise Threat Intelligence
RUSTSEC-2026-0001 - Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
Severity: info ยท Published 2026-01-05
Technologies: rkyv (crates.io). Vendors: crates.io.
Related threats
- rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
- rkyv memory corruption via panic-safety bugs in clear functions
- RUSTSEC-2026-0235 - Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
- RUSTSEC-2026-0233 - Crafted archives can cause a use-after-free during deserialization
- RUSTSEC-2026-0234 - Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables