# RUSTSEC-2026-0198: `Report::frames_mut` allows aliased mutable references

> A Rust library flaw allows aliased mutable references, causing undefined behavior and segmentation faults in applications using the affected crate.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 3 Jul 2026

## What is RUSTSEC-2026-0198?

RUSTSEC-2026-0198 is a memory corruption vulnerability in error-stack, published on 3 Jul 2026. 

### Official description

Affected versions of this crate return an iterator from
`Report::frames_mut` whose `&mut Frame` items have lifetimes independent
of the iterator, so all yielded references can be held at the same time.
A yielded frame's sources are also yielded by the iterator and reachable
through the parent frame via `Frame::sources_mut`, allowing safe code to
obtain two live mutable references to the same frame. This is undefined
behavior and can be used to cause a segmentation fault (see reproducer in
the linked issue). Versions 0.1.0 and 0.1.1 are affected through
`Frame::source_mut` instead of `Frame::sources_mut`.

The flaw is fixed in 0.8.0 by replacing the iterator with internal
iteration: `Report::frames_mut` now takes a visitor closure, so mutable
access to a frame is scoped and cannot overlap with access to its
sources.

## Which versions are affected by RUSTSEC-2026-0198?

1 open source package ship an affected version, including error-stack.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `error-stack` | crates.io | From 0.0.0-0 | 0.8.0 |

## How do I fix RUSTSEC-2026-0198?

Upgrade error-stack to 0.8.0 or later.

## Is RUSTSEC-2026-0198 being exploited?

There is no known exploitation of RUSTSEC-2026-0198 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for RUSTSEC-2026-0198 and fix it if it is affected.

What it is: RUSTSEC-2026-0198 is a memory corruption vulnerability in error-stack, published on 3 Jul 2026. 
Exploitation: There is no known exploitation of RUSTSEC-2026-0198 in the wild and no public exploit code.

Affected packages and fixed versions:
- error-stack (crates.io): affected from 0.0.0-0; fixed in 0.8.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/RUSTSEC-2026-0198/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0198/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/RUSTSEC-2026-0198

---
From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2026-0198/
Summaries are generated and may contain mistakes; the official description above is the record.