RUSTSEC-2026-0029

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0029

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0029.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0029

Aliases

GHSA-j8cj-hw74-64jv

Published

2026-02-26T12:00:00Z

Modified

2026-03-01T06:01:36Z

Summary

Double-free and use-after-free for Hive

Details

Drop implementation for Hive did perform free, but so did Hive::close, which, at the end of the scope performed Drop, therefore triggering double-free.

Additionally, function Hive::from_handle was not marked as unsafe, making it, in combination with as_handle easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hivex

Package

Name: hivex; View open source insights on deps.dev
Purl: pkg:cargo/hivex

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.2.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "functions": [
            "hivex::Hive::close",
            "hivex::Hive::from_handle"
        ],
        "os": [],
        "arch": []
    }
}