RUSTSEC-2026-0233

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0233

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0233.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0233

Published

2026-05-11T12:00:00Z

Modified

2026-08-04T09:30:04.420572601Z

Summary

Crafted archives can cause a use-after-free during deserialization

Details

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from_bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap use-after-free during string deserialization.

The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / rkyv

Package

Name: rkyv; View open source insights on deps.dev
Purl: pkg:cargo/rkyv

Affected ranges

Type: SEMVER
Events: Introduced

0.8.0-rc.1

Fixed

0.8.17

Ecosystem specific

{
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    },
    "affected_functions": null
}

Database specific

source

"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0233.json"