GHSA-vfvv-c25p-m7mm Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
A use-after-free vulnerability in rkyv allows memory corruption or double-free if a panic occurs during vector clearing, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vfvv-c25p-m7mm?
GHSA-vfvv-c25p-m7mm is an use after free vulnerability in rkyv, published on 23 Apr 2026.
Official description
InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe.
Both functions iterate over their elements and call drop_in_place on each,
updating self.len only after the loop. If an element's Drop implementation
panics during the loop, self.len is left at its original value.
A subsequent invocation of clear() on the same container then re-visits the
already-freed elements:
InlineVec::clear()is called again fromInlineVec's ownDropimplementation when the value is later dropped.SerVec::clear()is called again bySerVec::with_capacity()after the user closure returns.
Impact
- CWE-415 (Double Free): heap corruption when the element type is one that
owns memory, such as
Box<T>orVec<T> - CWE-416 (Use-After-Free): memory corruption when an element is accessed following a caught panic
Both types of undefined behavior can be invoked in safe Rust, but only if
unwinding panics are enabled and std::panic::catch_unwind is used.
Which versions are affected by GHSA-vfvv-c25p-m7mm?
3 open source packages ship an affected version, including rkyv.
| Package | Affected | Fixed in |
|---|---|---|
rkyv crates.io | From 0.8.0 | 0.8.16 |
rkyv crates.io | From 0.8.0 | 0.8.16 |
rkyv crates.io | From 0.8.0 | 0.8.16 |
How do I fix GHSA-vfvv-c25p-m7mm?
Upgrade rkyv to 0.8.16 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-vfvv-c25p-m7mm being exploited?
There is no known exploitation of GHSA-vfvv-c25p-m7mm in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0122.