# CVE-2026-44983: smallbitvec Memory Corruption (High 7.3) 🦀 🦀 crates.io Not in CISA KEV HIGH severity # CVE-2026-44983 — smallbitvec HIGH CVE-2026-44983 is a high-severity (CVSS 7.3) CWE-122 vulnerability in smallbitvec. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime. smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow Also known as[GHSA-97wc-2hqc-cjgr](/vulnerability/GHSA-97wc-2hqc-cjgr) Published May 26, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched None yet Exploits None indexed Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44983. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs4th percentile — riskier than 4% of all scored CVEsHighest risk 0.00%0.22%0.44%0.66%0.0%0.2%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🦀`smallbitvec` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary An integer overflow in the internal capacity calculation of `smallbitvec` can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring `unsafe` code from the caller. #### Details The issue originates from unchecked arithmetic in the internal helper function responsible for computing the required buffer size: ``` (cap + bits_per_storage() - 1) / bits_per_storage() ``` When `cap` is close to `usize::MAX`, the addition: ``` cap + bits_per_storage() - 1 ``` can overflow in release builds and wrap around due to Rust’s default wrapping semantics for integer overflow in optimized builds. As a result: - `buffer_len(cap)` may return a value significantly smaller than required. - The backing storage is allocated with insufficient size. - Internal metadata (logical length/capacity) reflects a much larger size than the actual allocation. Subsequent safe API calls (e.g., `set`, `push`, `reserve`) rely on this corrupted metadata and perform index computations that assume sufficient backing storage. These operations eventually reach unsafe internal code paths (e.g., pointer arithmetic and unchecked indexing), leading to out-of-bounds memory access. Summary of the issue: integer overflow → undersized allocation → inconsistent metadata (len/cap vs actual buffer) → unsafe internal access using corrupted metadata → heap buffer overflow (UB) #### PoC #### PoC 1: Out-of-bounds write via `from_elem` ``` #![forbid(unsafe_code)] use smallbitvec::SmallBitVec; fn main() { // Triggers overflow in buffer_len(cap) let mut v = SmallBitVec::from_elem(usize::MAX, false); // Logical length is large, but backing storage is undersized // This leads to out-of-bounds write in unsafe internals v.set(0, true); } ``` #### PoC 2: Overflow via `reserve` ``` #![forbid(unsafe_code)] use smallbitvec::SmallBitVec; fn main() { let mut v = SmallBitVec::new(); v.push(true); // Triggers overflow in capacity computation v.reserve(usize::MAX - 10); } ``` #### Impact - Heap buffer overflow via safe API only - ASAN-observable heap-buffer-overflow - Undefined Behavior detectable with Miri (e.g., out-of-bounds indexing due to corrupted metadata) #### Tested on - rustc 1.96.0-nightly (9602bda1d 2026-04-05) - Target: x86\_64-unknown-linux-gnu - Build: release - ASAN: `RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release` - Miri: `cargo +nightly miri run --release` ## Affected Packages 1 total Ecosystem Package Vulnerable range Fix 🦀crates.io `smallbitvec` ≥ 1.0.1 No fix ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for smallbitvec, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Remediation status The records we use list no patched version of smallbitvec for CVE-2026-44983. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range. 3. ### Mitigate without a patch Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatImportant Red Hat Product Security rates this vulnerability as Important because memory corruption can occur through standard interfaces, potentially leading to arbitrary code execution or application crashes. Exploitation requires an application to request bit-vector allocations approaching platform architecture limits, a… Workaround published by Red Hat > Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Source: [Red Hat security advisory for CVE-2026-44983](https://access.redhat.com/security/cve/cve-2026-44983) (CC BY 4.0) ## Frequently Asked Questions \### Summary An integer overflow in the internal capacity calculation of \`smallbitvec\` can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring \`unsafe\` code from the caller. ### Details The issue originates from unchecked arithmetic in the internal helper function responsible for computing the required buffer size: \`\`\` (cap + bits\_per\_storage() - 1) / bits\_per\_storage() \`\`\` When \`cap\` is close to \`usize::MAX\`, the addition: \`\`\` cap + bits\_per\_storage() - 1 \`\`\` can overflow in release builds and w O3 Security · Impact-Aware SCA ### Is CVE-2026-44983 in your dependencies? Find it across crates.io, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)