Lucene search
+L

2 matches found

RustSec
RustSec
added 2026/05/02 12:0 p.m.18 views

Null-pointer dereference and double-free via safe APIs

Two soundness violations exist in the Rust bindings for MetaCall: Null-pointer dereference: MetaCallFuture::newraw accepts a raw pointer without validation. The Debug impl calls Box::fromrawself.data on it. Passing a null pointer causes the Debug impl to construct a NonNull from null, producing...

5.8AI score
SaveExploits0
OSV
OSV
added 2026/05/02 12:0 p.m.10 views

RUSTSEC-2026-0128 Double-free and use-after-free in `Keys::next()`

Keys::next uses ptr::read to move out the Option by value, which drops the contained V when V is non-Copy e.g. String. This leaves a dangling value in the map's storage slot. Subsequent get operations on that key return a dangling reference to already-freed memory. This can be triggered through...

5.7AI score
SaveExploits0References3
Rows per page
Query Builder