---
id: RUSTSEC-2026-0233
title: Crafted archives can cause a use-after-free during deserialization
summary: Crafted archives can cause a use-after-free during deserialization
severity: none
vendor: rkyv
product: rkyv
ecosystem: rust
affected:
  - 'rkyv >= 0.8.0-rc.1, < 0.8.17'
patched:
  - rkyv 0.8.17
published: '2026-05-11'
updated: '2026-08-04'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0233'
references:
  - url: 'https://crates.io/crates/rkyv'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0233.html'
  - url: 'https://github.com/rkyv/rkyv/issues/666'
  - url: >-
      https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a
  - url: >-
      https://github.com/rkyv/rkyv/commit/107772907c4e839fa67900385f0d4814e7d15e42
tags:
  - osv
  - rust
ingestedAt: '2026-08-04T19:12:36.115Z'
---

## Overview

Insufficient archive range validation could allow a crafted archive to reach
`ArchivedString::deserialize` with an invalid pointer. A reported reproducer
used `rkyv::from_bytes` to deserialize a struct containing strings, a vector,
a box, and an optional hash map. AddressSanitizer detected a heap use-after-free
during string deserialization.

The flaw could be triggered through the safe checked deserialization API when
processing malicious archive bytes. Version 0.8.17 rejects the malformed
archive during validation. Users who process untrusted archives should upgrade
to 0.8.17 or later.

## Affected packages

- `rkyv >= 0.8.0-rc.1, < 0.8.17`

## Remediation

Upgrade to a patched release:

- `rkyv 0.8.17`