{"id":"RUSTSEC-2026-0252","title":"Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)","summary":"Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)","severity":"none","vendor":"orx-split-vec","product":"orx-split-vec","ecosystem":"rust","affected":["orx-split-vec >= 0.0.0-0, < 4.0.0"],"patched":["orx-split-vec 4.0.0"],"published":"2026-08-11","updated":"2026-08-11","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0252","references":[{"url":"https://crates.io/crates/orx-split-vec"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0252.html"},{"url":"https://github.com/orxfun/orx-split-vec/issues/95"}],"tags":["osv","rust"],"ingestedAt":"2026-08-11T19:17:10.451Z","slug":"RUSTSEC-2026-0252","body":"## Overview\n\n`SplitVec::extend_from_slice` increments the logical length `self.len` before cloning the incoming elements into the reserved slots. If an element's `Clone` panics mid-fill, unwinding leaves `self.len` counting slots that were never initialized. A later safe read (`get`, indexing, `iter`) then reads one of those uninitialized slots.\n\nThis is reachable from safe Rust — a read of uninitialized memory (CWE-908). It is not a double-free: `SplitVec` has no manual `Drop` and its elements live in a standard `Vec`, so the defect is a read, not a free.\n\n## Impact\n\nA safe read after the panic returns a value built from uninitialized bytes. For a heap-owning element type such as `String`, the resulting value has garbage length/pointer fields.\n\nConfirmed under Miri. AddressSanitizer stays silent for this class, since the uninitialized bytes are consumed as a non-dereferenced field rather than an invalid load or free.\n\n## Fix\n\nFixed in `orx-split-vec` 4.0.0, which no longer commits the length before the elements are cloned.\n\n## Affected packages\n\n- `orx-split-vec >= 0.0.0-0, < 4.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `orx-split-vec 4.0.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}