Crafted archives can cause a use-after-free during deserialization

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::frombytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap...

PT-2026-67781

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap...