{"id":"RUSTSEC-2026-0233","summary":"Crafted archives can cause a use-after-free during deserialization","details":"Insufficient archive range validation could allow a crafted archive to reach\n`ArchivedString::deserialize` with an invalid pointer. A reported reproducer\nused `rkyv::from_bytes` to deserialize a struct containing strings, a vector,\na box, and an optional hash map. AddressSanitizer detected a heap use-after-free\nduring string deserialization.\n\nThe flaw could be triggered through the safe checked deserialization API when\nprocessing malicious archive bytes. Version 0.8.17 rejects the malformed\narchive during validation. Users who process untrusted archives should upgrade\nto 0.8.17 or later.","modified":"2026-08-04T09:30:04.420572601Z","published":"2026-05-11T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/rkyv"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0233.html"},{"type":"REPORT","url":"https://github.com/rkyv/rkyv/issues/666"},{"type":"WEB","url":"https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a"},{"type":"WEB","url":"https://github.com/rkyv/rkyv/commit/107772907c4e839fa67900385f0d4814e7d15e42"}],"affected":[{"package":{"name":"rkyv","ecosystem":"crates.io","purl":"pkg:cargo/rkyv"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0-rc.1"},{"fixed":"0.8.17"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":[],"arch":[]}},"database_specific":{"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0233.json","categories":["memory-corruption"]}}],"schema_version":"1.8.0"}