Hive has Double-free and Use After Free Vulnerabilities

published 2026-02-26 8mo ago modified 2026-03-01 8mo ago also RUSTSEC-2026-0029

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free.

Additionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with `as_handle` easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.

Patch / fix

fixed in 1 links 1

crates.io hivex 0.2.1

codeberg.org/1millibyte/toolsnt@f4c7a0d commit

Is GHSA-j8cj-hw74-64jv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	hivex	>=0.2.0, <0.2.1 >=0.0.0-0, <0.2.1	0.2.1

Classification

Weakness

CWE-415 Double Free
CWE-416 Use After Free

References

codeberg.org /1millibyte/toolsnt/commit/f4c7a0d1fc4a08ce40bb76e447a69a6f383a916e
web
codeberg.org /1millibyte/toolsnt/issues/18
web
docs.rs /crate/hivex
web
docs.rs /crate/hivex/0.2.1/source
web
rustsec.org /advisories/RUSTSEC-2026-0029.html
web, advisory
crates.io /crates/hivex
package

Sources

GitHub Advisory GHSA-j8cj-hw74-64jv
OSV RUSTSEC-2026-0029

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.