Skip to content
Fencer Intel
no cvss —

RUSTSEC-2026-0128 json

Double-free and use-after-free in `Keys::next()`

published 6mo ago modified 5mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

`Keys::next()` uses `ptr::read` to move out the `Option<V>` by value, which drops the contained `V` when `V` is non-Copy (e.g. `String`). This leaves a dangling value in the map's storage slot. Subsequent `get()` operations on that key return a dangling reference to already-freed memory.

This can be triggered through safe public APIs — `Map::keys()`, `Keys::next()`, and `Map::get()` — with no `unsafe` required from the caller. Under Miri, accessing the freed slot produces "Undefined Behavior: pointer not dereferenceable: alloc has been freed, so this pointer is dangling".

Is RUSTSEC-2026-0128 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io emap
>=0.0.0-0
 no fix listed

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.