RUSTSEC-2026-0233None▾ SunlitCrafted archives can cause a use-after-free during deserialization
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Insufficient archive range validation could allow a crafted archive to reach
ArchivedString::deserialize with an invalid pointer. A reported reproducer
used rkyv::from_bytes to deserialize a struct containing strings, a vector,
a box, and an optional hash map. AddressSanitizer detected a heap use-after-free
during string deserialization.
The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.
rkyv >= 0.8.0-rc.1, < 0.8.17Upgrade to a patched release:
rkyv 0.8.17Connected by shared product, vendor, weakness, or advisory.