Use-After-Free and Double-Free in IntoIter::drop when element drop panics

published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also GHSA-xphw-cqx3-667j , RUSTSEC-2026-0103 , EUVD-2026-23832

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

Patch / fix

fixed in 1 distros 1 links 1

crates.io thin-vec 0.2.16

rust-thin-vec Debian 14 0.2.17-1

debian advisories DEBIAN-CVE-2026-6654

github.com/mozilla/thin-vec@df64748 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6654 updated 2026-11-04 cvss 7.3

thin-vec: mozilla/thin-vec: Memory corruption vulnerability via Double-Free/Use-After-Free

Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, firefox, rustfmt, +10 more Red Hat Enterprise Linux 9 gjs, rust, cargo, clippy, firefox, rustfmt, +12 more Red Hat Enterprise Linux 10 gjs, rust, firefox, thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 rust
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-20)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADP	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD	3.1	5.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA	3.1	5.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
OSV	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
GitHub	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected packages

ecosystem	package	affected	fixed in
crates.io	thin-vec	<0.2.16 >=0.0.0-0, <0.2.16	0.2.16

Affected products

Mozilla thin-vec
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

Classification

Weakness

CWE-415 Double Free
CWE-416 Use After Free
CWE-1341 Multiple Releases of Same Resource or Handle

References

github.com /mozilla/thin-vec/commit/df64748355222525c344ecd9d2c9f59a662e1678
web
github.com /mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j
web, exploit, vendor-advisory
access.redhat.com /security/cve/CVE-2026-6654
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=2459689
issue-tracking
security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-6654.json
nvd.nist.gov /vuln/detail/CVE-2026-6654
advisory
github.com /mozilla/thin-vec
package
rustsec.org /advisories/RUSTSEC-2026-0103.html
web, advisory
crates.io /crates/thin-vec
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary