PT-2026-40746 · Crates.Io · Metacall

Published

2026-05-02

·

Updated

2026-05-02

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Two soundness violations exist in the Rust bindings for MetaCall:
Null-pointer dereference: MetaCallFuture::new raw() accepts a raw pointer without validation. The Debug impl calls Box::from raw(self.data) on it. Passing a null pointer causes the Debug impl to construct a NonNull from null, producing undefined behavior.
Double-free: MetaCallPointer::clone() shares the same rust value raw pointer between the clone and the original. Calling get value untyped() on both clones calls Box::from raw on the same pointer twice, resulting in a double-free.
Both issues can be triggered through safe public APIs — MetaCallFuture::new raw(), MetaCallPointer::new(), clone(), and get value untyped() — with no unsafe required from the caller.
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

RUSTSEC-2026-0139

Affected Products

Metacall