The unbounded_spsc queue, for releases 0.2.0 and earlier, contains a flaw in the Sender::send implementation where a pointer is transmuted as a value. This mis‑typed transmute leads to an out‑of‑bounds read and a fake Arc drop when a transmit and receive operation race. The code paths involved have been classified as CWE‑125, CWE‑415, CWE‑704, and CWE‑787. The resulting uncontrolled memory corruption could allow leaking or corrupting data or cause the process to terminate. The CVSS score of 5.8 reflects moderate severity.

The affected product is spearman's unbounded‑spsc Rust library. Versions 0.2.0 and earlier are known to contain the flaw; the status of later releases is unknown because the advisory does not provide version comparisons beyond 0.2.0.

The EPSS score is below 1 %, indicating an unlikely exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a concurrent transmit/receive race on the queue, which an attacker could trigger only if they have influence over the application’s concurrent execution environment. The attack vector therefore is inferred to be a race condition that must occur between a sender and a receiver during operation.