RUSTSEC-2026-0156 Bad-free in `MetaCallException::new`

Not scored Published 1 Jun 2026

A use-after-free vulnerability in the Rust metacall library allows attackers to trigger a bad-free via the safe API, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Not stated
Victim action needed: Not needed
Fix: None listed

What is RUSTSEC-2026-0156?

RUSTSEC-2026-0156 is an use after free vulnerability in metacall, published on 1 Jun 2026.

Official description

exception_struct is a local stack variable, but the code passes its address to the C language as &mut exception_struct as *mut _ as *mut c_void. Then, the returned MetaCallException value is stored here:

Ok(Self {
    exception_struct: Arc::new(exception_struct),
    value: exception_ptr,
    leak: false,
})

Because leak is false, the destructor will run later. But the original exception pointer points to Rust stack memory.

Trigger

#[test]
fn exception_bad_free_safe_api() {
    let original = metacall::MetaCallException::new(
        &#34;test&#34;,
        &#34;test&#34;,
        &#34;test&#34;,
        1,
    );

    drop(original); // AddressSanitizer: bad-free
}

Impact

Every time the MetaCallException is created, when it is dropped, it leads to a bad-free. This can be triggered through the safe public API MetaCallException::new(), with no unsafe required from the caller.

Which versions are affected by RUSTSEC-2026-0156?

1 open source package ship an affected version, including metacall.

Package	Affected	Fixed in
`metacall` crates.io	From `0.0.0-0`	None

How do I fix RUSTSEC-2026-0156?

No fix has been published for RUSTSEC-2026-0156 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is RUSTSEC-2026-0156 being exploited?

There is no known exploitation of RUSTSEC-2026-0156 in the wild and no public exploit code.