RUSTSEC-2026-0156: Bad-free in `MetaCallException::new`

What to do

1. Find who pulls it in: cargo tree -i metacall.
2. Avoid the affected API, or replace the crate.

Details from the advisory

exception_struct is a local stack variable, but the code passes its address to the C language as &mut exception_struct as *mut _ as *mut c_void. Then, the returned MetaCallException value is stored here:

Ok(Self {
    exception_struct: Arc::new(exception_struct),
    value: exception_ptr,
    leak: false,
})

Because leak is false, the destructor will run later. But the original exception pointer points to Rust stack memory.

Trigger

#[test]
fn exception_bad_free_safe_api() {
    let original = metacall::MetaCallException::new(
        "test",
        "test",
        "test",
        1,
    );

    drop(original); // AddressSanitizer: bad-free
}

Impact

Every time the MetaCallException is created, when it is dropped, it leads to a bad-free. This can be triggered through the safe public API MetaCallException::new(), with no unsafe required from the caller.

References

• Package: crates.io/crates/metacall
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0156.html
• Report: github.com/metacall/core/issues/809

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for metacall

• UnsoundRUSTSEC-2026-0139 · 2026-05-02Null-pointer dereference and double-free via safe APIs
• UnsoundRUSTSEC-2026-0157 · 2026-06-01Several memory corruption issues via safe APIs

Full security history of metacall