PT-2026-33753 · Mozilla · Thin-Vec

Juhyung Son · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6654

Mitre

CVSS v3.1

5.1

Medium

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Double-Free / Use-After-Free (UAF) in the IntoIter::drop and ThinVec::clear functions in the thin vec crate. A panic in ptr::drop in place skips setting the length to zero.

Fix

Double Free

Use After Free

Weakness Enumeration

CWE-415

CWE-416

Related Identifiers

CVE-2026-6654

Affected Products

Thin-Vec

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-6654 · Security Note
• https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j · Note