{"id":"RUSTSEC-2026-0282","title":"Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics","summary":"Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics","severity":"none","vendor":"aligned_box","product":"aligned_box","ecosystem":"rust","affected":["aligned_box >= 0.0.0-0, < 0.3.1"],"patched":["aligned_box 0.3.1"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T11:00:05.081134157Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0282","references":[{"url":"https://crates.io/crates/aligned_box"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0282.html"},{"url":"https://github.com/michaellass/aligned_box/pull/6"}],"tags":["osv","rust"],"ingestedAt":"2026-09-10T03:08:29.637Z","slug":"RUSTSEC-2026-0282","body":"## Overview\n\nShrinking an `AlignedBox<[T]>` takes ownership of the buffer out of\n`self.container` with `ManuallyDrop::take`, destroys the elements past the new\nlength, and only then commits the new `Box` back into `self.container`.\n`ManuallyDrop::take` moves ownership but not the bits, so until that commit\n`self.container` still points at the original buffer.\n\n`T::drop` runs inside the destruction loop and is user code — `T` carries no\nbound that would exclude a panicking `Drop`. If it unwinds, the commit is\nskipped and `self.container` is left pointing at the buffer whose tail has\nalready been destroyed. `AlignedBox`'s own destructor then reconstructs a `Box`\nfrom that pointer, drops every element again and deallocates — a double free\n(CWE-415) / use-after-free (CWE-416) reachable from safe Rust.\n\nGrowing the slice destroys nothing and is unaffected, as is\n`realloc_with_value`, which requires `T: Copy` and therefore a `Drop` that\ncannot run.\n\n## Mitigation\n\nUpdate to 0.3.1.\n\n## Affected packages\n\n- `aligned_box >= 0.0.0-0, < 0.3.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aligned_box 0.3.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}