Reported

August 12, 2026

Issued

September 21, 2026

Package

z3 (crates.io)

Type

Vulnerability

Categories

• memory-corruption

References

• https://github.com/prove-rs/z3.rs/pull/578

Patched

• >=0.21.0

Description

The ApplyResult type contains a raw pointer to a C++ memory object and has a derived Clone implementation which creates a reference to this object without incrementing the associated reference counter.

As a result, if an instance of ApplyResult is duplicated through Clone and both instances are dropped a use-after-free can occur.

Advisory available under CC0-1.0 license.