{"id":"RUSTSEC-2026-0235","summary":"Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc","details":"Shared pointer validation keyed already-validated pointees by their address and\ntype, but did not include pointer metadata. For unsized pointees, an archive\ncould therefore contain multiple `Rc`, `Arc`, or weak pointers that shared a\ndata address but used different metadata, such as different slice lengths.\n\nOnce the first pointer had been validated, later pointers to the same address\nskipped pointee validation. The safe checked `rkyv::access` API could\nconsequently return a slice with a forged length, allowing safe indexing to\nread out of bounds. The same validation bypass was reachable through checked\ndeserialization with `rkyv::from_bytes`.\n\nVersion 0.8.17 includes pointer metadata in shared pointer validation and\nrejects conflicting metadata. The 0.7 series is also affected but is no\nlonger supported by upstream. Users who process untrusted archives should upgrade\nto 0.8.17 or later.","modified":"2026-08-04T09:30:04.382146100Z","published":"2026-05-13T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/rkyv"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0235.html"},{"type":"REPORT","url":"https://github.com/rkyv/rkyv/issues/670"},{"type":"WEB","url":"https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a"}],"affected":[{"package":{"name":"rkyv","ecosystem":"crates.io","purl":"pkg:cargo/rkyv"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0-pre.2"},{"fixed":"0.8.17"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"os":[],"functions":[]}},"database_specific":{"categories":["memory-exposure"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0235.json"}}],"schema_version":"1.8.0"}