Executive brief
Crafted archives can cause a use-after-free during deserialization
Affected products
- crates.io rkyv
Junglewise Threat Intelligence
RUSTSEC-2026-0233 - Crafted archives can cause a use-after-free during deserialization
Severity: info ยท Published 2026-05-11
Technologies: rkyv (crates.io). Vendors: crates.io.
Related threats
- rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
- rkyv memory corruption via panic-safety bugs in clear functions
- RUSTSEC-2026-0235 - Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
- RUSTSEC-2026-0234 - Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
- RUSTSEC-2026-0122 - Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`