CVE-2026-6654
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
- CVSS 3.1
- 5.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-26)
- CWEs
- CWE-415, CWE-416, CWE-1341
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mozilla:thin-vec
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xphw-cqx3-667j | crates.io | thin-vec | <0.2.16 | 0.2.16 |
| RUSTSEC-2026-0103 | crates.io | thin-vec | >=0.0.0-0 <0.2.16 | 0.2.16 |