---
id: RUSTSEC-2026-0295
title: Memory corruption bug on `ApplyResult` type
summary: Memory corruption bug on `ApplyResult` type
severity: none
vendor: z3
product: z3
ecosystem: rust
affected:
  - 'z3 >= 0.0.0-0, < 0.21.0'
patched:
  - z3 0.21.0
published: '2026-08-12'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T10:15:04.329850030Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0295'
references:
  - url: 'https://crates.io/crates/z3'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0295.html'
  - url: 'https://github.com/prove-rs/z3.rs/pull/578'
tags:
  - osv
  - rust
ingestedAt: '2026-09-21T16:06:16.787Z'
---

## Overview

The `ApplyResult` type contains a raw pointer to a C++ memory object and has a derived `Clone` implementation which creates a reference to this object without incrementing the associated reference counter. 

As a result, if an instance of `ApplyResult` is duplicated through `Clone` and both instances are dropped a use-after-free can occur.

## Affected packages

- `z3 >= 0.0.0-0, < 0.21.0`

## Remediation

Upgrade to a patched release:

- `z3 0.21.0`