PT-2026-3079 · Crates.Io · Rkyv
Published
2026-01-05
·
Updated
2026-01-05
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The
SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).This null pointer can flow through to
SharedPointer::from value, which calls Box::from raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from bytes or rkyv::deserialize using) if an OOM condition occurs during the allocation of the shared pointer.The issue is reachable through safe code and violates Rust's safety guarantees.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rkyv