rustsec-2026-0233
Vulnerability from osv_rustsec
Published
2026-05-11 12:00
Modified
2026-08-04 09:27
Summary
Crafted archives can cause a use-after-free during deserialization
Details

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from_bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap use-after-free during string deserialization.

The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "rkyv",
        "purl": "pkg:cargo/rkyv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0-rc.1"
            },
            {
              "fixed": "0.8.17"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Insufficient archive range validation could allow a crafted archive to reach\n`ArchivedString::deserialize` with an invalid pointer. A reported reproducer\nused `rkyv::from_bytes` to deserialize a struct containing strings, a vector,\na box, and an optional hash map. AddressSanitizer detected a heap use-after-free\nduring string deserialization.\n\nThe flaw could be triggered through the safe checked deserialization API when\nprocessing malicious archive bytes. Version 0.8.17 rejects the malformed\narchive during validation. Users who process untrusted archives should upgrade\nto 0.8.17 or later.",
  "id": "RUSTSEC-2026-0233",
  "modified": "2026-08-04T09:27:20Z",
  "published": "2026-05-11T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/rkyv"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0233.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rkyv/rkyv/issues/666"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rkyv/rkyv/commit/107772907c4e839fa67900385f0d4814e7d15e42"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Crafted archives can cause a use-after-free during deserialization"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.