RUSTSEC-2026-0139: Null-pointer dereference and double-free via safe APIs

What to do

1. Find who pulls it in: cargo tree -i metacall.
2. Avoid the affected API, or replace the crate.

Details from the advisory

Two soundness violations exist in the Rust bindings for MetaCall:

**Null-pointer dereference:** MetaCallFuture::new_raw() accepts a raw pointer without validation. The Debug impl calls Box::from_raw(self.data) on it. Passing a null pointer causes the Debug impl to construct a NonNull from null, producing undefined behavior.

**Double-free:** MetaCallPointer::clone() shares the same rust_value raw pointer between the clone and the original. Calling get_value_untyped() on both clones calls Box::from_raw on the same pointer twice, resulting in a double-free.

Both issues can be triggered through safe public APIs , MetaCallFuture::new_raw(), MetaCallPointer::new(), clone(), and get_value_untyped() , with no unsafe required from the caller.

References

• Package: crates.io/crates/metacall
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0139.html
• Report: github.com/metacall/core/issues/618

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for metacall

• VulnerabilityRUSTSEC-2026-0156 · 2026-06-01Bad-free in `MetaCallException::new`
• UnsoundRUSTSEC-2026-0157 · 2026-06-01Several memory corruption issues via safe APIs

Full security history of metacall