Reported

May 11, 2026

Issued

August 4, 2026

Package

rkyv (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#use-after-free #validation #deserialization

References

• https://github.com/rkyv/rkyv/issues/666
• https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a
• https://github.com/rkyv/rkyv/commit/107772907c4e839fa67900385f0d4814e7d15e42

Patched

• >=0.8.17

Unaffected

• <0.8.0-rc.1

Description

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from_bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap use-after-free during string deserialization.

The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.

Advisory available under CC0-1.0 license.