{"id":"RUSTSEC-2026-0272","title":"Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)","summary":"Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)","severity":"none","vendor":"stack_dst","product":"stack_dst","ecosystem":"rust","affected":["stack_dst >= 0.0.0-0, < 0.8.2"],"patched":["stack_dst 0.8.2"],"published":"2026-08-27","updated":"2026-08-31","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0272","references":[{"url":"https://crates.io/crates/stack_dst"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0272.html"},{"url":"https://github.com/thepowersgang/stack_dst-rs/issues/16"}],"tags":["osv","rust"],"ingestedAt":"2026-08-31T19:30:40.346Z","slug":"RUSTSEC-2026-0272","body":"## Overview\n\nThree removal and replacement paths destroy an initialized value before\ncommitting the metadata change that removes it. Destruction runs `T::drop()`,\nwhich is user code and may panic. If it does, the commit is skipped and the\ncontainer still claims ownership of the already-destroyed value, so its own\ndestructor drops that value a second time.\n\n`Stack::pop` drops the top value before reducing `next_ofs`. `Stack`'s\ndestructor pops in a loop, so an unchanged `next_ofs` re-drops the same value.\n\n`Fifo::pop_front` (via `pop_front_inner`) drops the front value before advancing\n`read_pos`. An unchanged `read_pos` still points at the destroyed value.\n\n`Value::replace_stable` drops the existing value before writing the replacement.\nIf the destructor panics the replacement is never written, but the backing\nstorage still holds the old value's metadata.\n\nThis is separate from RUSTSEC-2021-0033, which covered a clone panic on\ninsertion in `push_cloned` and was fixed in 0.6.1.\n\n## Impact\n\nA heap-owning value is freed twice, corrupting the allocator. Reachable from\nsafe Rust with any element type whose `Drop` can panic — no `unsafe` on the\ncaller's side.\n\n* CWE-415 (Double Free)\n* CWE-416 (Use-After-Free)\n\nConfirmed under AddressSanitizer, which reports `attempting double-free` on all\nthree paths.\n\n## Fix\n\nFixed in 0.8.2.\n\n## Affected packages\n\n- `stack_dst >= 0.0.0-0, < 0.8.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stack_dst 0.8.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}