---
id: RUSTSEC-2026-0235
title: >-
  Insufficient archive validation can cause out-of-bounds reads in archives
  containing Rc/Arc
summary: >-
  Insufficient archive validation can cause out-of-bounds reads in archives
  containing Rc/Arc
severity: none
vendor: rkyv
product: rkyv
ecosystem: rust
affected:
  - 'rkyv >= 0.7.0-pre.2, < 0.8.17'
patched:
  - rkyv 0.8.17
published: '2026-05-13'
updated: '2026-08-04'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0235'
references:
  - url: 'https://crates.io/crates/rkyv'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0235.html'
  - url: 'https://github.com/rkyv/rkyv/issues/670'
  - url: >-
      https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a
tags:
  - osv
  - rust
ingestedAt: '2026-08-04T19:12:36.174Z'
---

## Overview

Shared pointer validation keyed already-validated pointees by their address and
type, but did not include pointer metadata. For unsized pointees, an archive
could therefore contain multiple `Rc`, `Arc`, or weak pointers that shared a
data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address
skipped pointee validation. The safe checked `rkyv::access` API could
consequently return a slice with a forged length, allowing safe indexing to
read out of bounds. The same validation bypass was reachable through checked
deserialization with `rkyv::from_bytes`.

Version 0.8.17 includes pointer metadata in shared pointer validation and
rejects conflicting metadata. The 0.7 series is also affected but is no
longer supported by upstream. Users who process untrusted archives should upgrade
to 0.8.17 or later.

## Affected packages

- `rkyv >= 0.7.0-pre.2, < 0.8.17`

## Remediation

Upgrade to a patched release:

- `rkyv 0.8.17`