ArcIntern::drop has a race condition where it can release memory which is about to get another user. The new user will get a reference to freed memory.
This was fixed by serializing access to an interned object while it is being deallocated.
Versions prior to 0.3.12 used stronger locking which avoided the problem.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-362" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2021-08-19T21:19:06Z" }