RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
Attackers can cause out-of-bounds reads or crashes by providing crafted archives to applications using the rkyv library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0234?
RUSTSEC-2026-0234 is a memory corruption vulnerability in rkyv, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The archive validator could accept certain malformed relative pointers and
invalid ArchivedHashTable states. In particular, the hash table verifier did
not ensure that the number of occupied buckets matched the table's declared
length.
A crafted archive could pass the checks performed by the safe rkyv::access
and rkyv::from_bytes APIs and then cause an out-of-bounds read in later
validation, lookup, or deserialization. Depending on the input, this could
perform scalar or SIMD reads outside the archive buffer or crash the process.
Version 0.8.17 strengthens archive range validation and rejects hash tables whose number of occupied buckets does not match their declared length. Users who process untrusted archives should upgrade to 0.8.17 or later.
Which versions are affected by RUSTSEC-2026-0234?
1 open source package ship an affected version, including rkyv.
| Package | Affected | Fixed in |
|---|---|---|
rkyv crates.io | From 0.8.0-rc.1 | 0.8.17 |
How do I fix RUSTSEC-2026-0234?
Upgrade rkyv to 0.8.17 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2026-0234 being exploited?
There is no known exploitation of RUSTSEC-2026-0234 in the wild and no public exploit code.