RUSTSEC-2026-0139 Null-pointer dereference and double-free via safe APIs
Safe API misuse in Rust MetaCall bindings causes null-pointer dereference and double-free, leading to crashes or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0139?
RUSTSEC-2026-0139 is a vulnerability in metacall, published on 2 May 2026.
Official description
Two soundness violations exist in the Rust bindings for MetaCall:
Null-pointer dereference: MetaCallFuture::new_raw() accepts a raw
pointer without validation. The Debug impl calls Box::from_raw(self.data)
on it. Passing a null pointer causes the Debug impl to construct a
NonNull from null, producing undefined behavior.
Double-free: MetaCallPointer::clone() shares the same rust_value raw
pointer between the clone and the original. Calling get_value_untyped() on
both clones calls Box::from_raw on the same pointer twice, resulting in a
double-free.
Both issues can be triggered through safe public APIs —
MetaCallFuture::new_raw(), MetaCallPointer::new(), clone(), and
get_value_untyped() — with no unsafe required from the caller.
Which versions are affected by RUSTSEC-2026-0139?
1 open source package ship an affected version, including metacall.
| Package | Affected | Fixed in |
|---|---|---|
metacall crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0139?
No fix has been published for RUSTSEC-2026-0139 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2026-0139 being exploited?
There is no known exploitation of RUSTSEC-2026-0139 in the wild and no public exploit code.