RUSTSEC-2026-0235: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

What to do

1. See which version you have: cargo tree -i rkyv (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rkyv. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rkyv = "0.8.17") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address skipped pointee validation. The safe checked rkyv::access API could consequently return a slice with a forged length, allowing safe indexing to read out of bounds. The same validation bypass was reachable through checked deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.

References

• Package: crates.io/crates/rkyv
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0235.html
• Report: github.com/rkyv/rkyv/issues/670
• Web: github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rkyv

• Vulnerability HighRUSTSEC-2021-0054 · 2021-04-28Archives may contain uninitialized memory
• VulnerabilityRUSTSEC-2026-0001 · 2026-01-05Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
• UnsoundRUSTSEC-2026-0122 · 2026-04-23Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
• VulnerabilityRUSTSEC-2026-0233 · 2026-05-11Crafted archives can cause a use-after-free during deserialization
• VulnerabilityRUSTSEC-2026-0234 · 2026-05-11Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables

Full security history of rkyv