GHSA-7mcq-f592-pf7v Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs
Four double-free vulnerabilities in slice-ring-buffer allow attackers to trigger memory corruption and potential code execution via safe APIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-7mcq-f592-pf7v?
GHSA-7mcq-f592-pf7v is an use after free vulnerability in slice-deque, published on 16 Jun 2025.
Official description
The crate slice-ring-buffer was developed as a fork of slice-deque to continue maintenance and provide security patches, since the latter has been officially unmaintained (RUSTSEC-2020-0158).
While slice-ring-buffer has addressed some previously reported memory safety issues inherited from its fork origin (RUSTSEC-2021-0047), it still retains multiple unresolved memory corruption vulnerabilities.
Specifically, we have discovered four new memory safety bugs, each resulting in double-free violations that can occur when only safe APIs are invoked. These vulnerabilities correspond to four distinct safe APIs in the crate, each exposing unsound and vulnerable behavior due to incorrect usage of unsafe code internally.
Unfortunately, the maintainer doesn't have much availability to resolve these issues so there's no concrete timeline for fixes. Community contributions towards fixing these vulnerabilities would be much appreciated.
Which versions are affected by GHSA-7mcq-f592-pf7v?
5 open source packages ship an affected version, including slice-deque and slice-ring-buffer.
| Package | Affected | Fixed in |
|---|---|---|
slice-deque crates.io | All versions to 0.3.0 | None |
slice-deque crates.io | All versions to 0.3.0 | None |
slice-ring-buffer crates.io | All versions to 0.3.4 | None |
slice-ring-buffer crates.io | All versions to 0.3.4 | None |
slice-ring-buffer crates.io | From 0.0.0-0 | None |
How do I fix GHSA-7mcq-f592-pf7v?
No fix has been published for GHSA-7mcq-f592-pf7v yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-7mcq-f592-pf7v being exploited?
There is no known exploitation of GHSA-7mcq-f592-pf7v in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0044.