VulnerabilityRUSTSEC-2026-0233 · rkyv
RUSTSEC-2026-0233: Crafted archives can cause a use-after-free during deserialization
Short answerA security vulnerability in the rkyv crate: Crafted archives can cause a use-after-free during deserialization. No severity score was published. Fixed in 0.8.17: update to a fixed version.
| Crate | rkyv |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | From 0.8.0-rc.1 before 0.8.17. |
| Fixed in | 0.8.17 |
| Severity | not scored |
| Published | 2026-05-11 |
| Last changed | 2026-08-04 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i rkyv(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p rkyv. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplerkyv = "0.8.17") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from_bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap use-after-free during string deserialization.
The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.
References
- Package: crates.io/crates/rkyv
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0233.html
- Report: github.com/rkyv/rkyv/issues/666
- Web: github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a
- Web: github.com/rkyv/rkyv/commit/107772907c4e839fa67900385f0d4814e7d15e42
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for rkyv
- Vulnerability HighRUSTSEC-2021-0054 · 2021-04-28Archives may contain uninitialized memory
- VulnerabilityRUSTSEC-2026-0001 · 2026-01-05Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
- UnsoundRUSTSEC-2026-0122 · 2026-04-23Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
- VulnerabilityRUSTSEC-2026-0234 · 2026-05-11Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
- VulnerabilityRUSTSEC-2026-0235 · 2026-05-13Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Up next
Same craterkyv: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?