RUSTSEC-2026-0235

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0235

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0235.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0235

Published

2026-05-13T12:00:00Z

Modified

2026-08-04T09:30:04.382146100Z

Summary

Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Details

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address skipped pointee validation. The safe checked rkyv::access API could consequently return a slice with a forged length, allowing safe indexing to read out of bounds. The same validation bypass was reachable through checked deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / rkyv

Package

Name: rkyv; View open source insights on deps.dev
Purl: pkg:cargo/rkyv

Affected ranges

Type: SEMVER
Events: Introduced

0.7.0-pre.2

Fixed

0.8.17

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "functions": [],
        "os": [],
        "arch": []
    }
}

Database specific

source

"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0235.json"

informational

null

cvss

null