RUSTSEC-2026-0267 Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
A panic during element drop in BitVecCore::clear causes double-free and use-after-free, allowing memory corruption or crashes in applications using stable-vec.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0267?
RUSTSEC-2026-0267 is an use after free vulnerability in stable-vec, published on 24 Aug 2026.
Official description
BitVecCore::clear drops every occupied element with drop_in_place and only
afterwards clears the occupancy bits and resets len. If an element's Drop
panics, those metadata updates are skipped, so the slot of the already-dropped
element stays marked as occupied. BitVecCore::drop calls clear() again,
visits the same slot, and drops the element a second time — a double-free /
use-after-free reachable from safe Rust.
Reachable via the public StableVec::clear and ExternStableVec::clear, which
delegate to BitVecCore::clear.
Impact
- CWE-415 (Double Free): the same allocation is freed twice.
- CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated
Drop.
Reachable entirely from safe Rust via catch_unwind with element types whose
Drop can panic. Confirmed under AddressSanitizer on 0.4.2.
Fix
Fixed in stable-vec 0.4.3 by removing each element via remove_at, which
clears the occupancy bit before taking the value out.
Release 0.4.3 also fixes several other panic-safety issues found by the maintainer; see GHSA-mr2v-63pc-gmr4 and the 0.4.3 changelog for the full list.
Which versions are affected by RUSTSEC-2026-0267?
1 open source package ship an affected version, including stable-vec.
| Package | Affected | Fixed in |
|---|---|---|
stable-vec crates.io | From 0.0.0-0 | 0.4.3 |
How do I fix RUSTSEC-2026-0267?
Upgrade stable-vec to 0.4.3 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0267 being exploited?
There is no known exploitation of RUSTSEC-2026-0267 in the wild and no public exploit code.
Sources
Also known as GHSA-mr2v-63pc-gmr4.