RUSTSEC-2026-0128 Double-free and use-after-free in `Keys::next()`
A double-free and use-after-free vulnerability in a Rust map library allows attackers to trigger undefined behavior and potential code execution via safe public APIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0128?
RUSTSEC-2026-0128 is an use after free vulnerability in emap, published on 2 May 2026.
Official description
Keys::next() uses ptr::read to move out the Option<V> by value, which
drops the contained V when V is non-Copy (e.g. String). This leaves a
dangling value in the map's storage slot. Subsequent get() operations on
that key return a dangling reference to already-freed memory.
This can be triggered through safe public APIs — Map::keys(),
Keys::next(), and Map::get() — with no unsafe required from the
caller. Under Miri, accessing the freed slot produces "Undefined Behavior:
pointer not dereferenceable: alloc has been freed, so this pointer is
dangling".
Which versions are affected by RUSTSEC-2026-0128?
1 open source package ship an affected version, including emap.
| Package | Affected | Fixed in |
|---|---|---|
emap crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0128?
No fix has been published for RUSTSEC-2026-0128 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0128 being exploited?
There is no known exploitation of RUSTSEC-2026-0128 in the wild and no public exploit code.