CVE-2026-6654

Use-After-Free and Double-Free in IntoIter::drop when element drop panics

View on CVE.org
Published Apr 20, 2026 CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

Analysis

AI-generated

Technical impact

The thin_vec crate contains an internal data structure ThinVec with IntoIter::drop and ThinVec::clear. If an element’s drop function panics while iterating or clearing, the drop logic fails to set the length to zero, leaving a dangling pointer. This leads to a double free or use‑after‑free vulnerability (CWE‑415 and CWE‑416). The resulting memory corruption can cause program crashes or other unintended behavior.

Affected Systems

Mozilla thin-vec – all versions prior to the patch are affected; no specific version information is provided in the advisory.

Risk and Exploitability

The CVSS score is 5.1, and the EPSS score is less than 1%, indicating a low exploitation probability. The CVE is not listed in the CISA KEV catalog. The risk cannot be fully evaluated until a fix is released.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the thin-vec crate to the latest release once a patch is available.
  • Add a defensive check that resets the vector length to zero before dropping elements, or replace the drop implementation with custom logic to avoid double free when panics occur.
  • Enable runtime memory checking (e.g., address sanitizer or other tools) to detect double free or use‑after‑free incidents during development and testing.

Generated by OpenCVE AI on April 22, 2026 at 07:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-xphw-cqx3-667j thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
History
Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:thin-vec:0.2.15:*:*:*:*:rust:*:*
Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla thin-vec
Vendors & Products Mozilla
Mozilla thin-vec
Type Values Removed Values Added
Weaknesses CWE-415
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-416
Type Values Removed Values Added
Description Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
Title Use-After-Free and Double-Free in IntoIter::drop when element drop panics
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Jul 15, 2026, 12:41 AM
Reserved
Apr 20, 2026, 7:02 AM

View source JSON

Updated
Jul 15, 2026, 12:41 AM

JSON

Status
Modified
Published
Apr 20, 2026, 11:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

Severity
Important
Public date
Apr 20, 2026, 10:05 AM

View source Bugzilla JSON

Updated
Apr 22, 2026, 7:30 AM

JSON