Vulnerability · Published Apr 20, 2026 · Assigned by mozilla
CVE-2026-6654Use-After-Free and Double-Free in IntoIter::drop when element drop panics
Medium 5.1
In plain English
A medium-severity double free in thin-vec from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.1Medium
Exploit odds (30 days)0.2%top 93.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-thin-vec | no fix listed | DEBIAN-CVE-2026-6654 |
| Debian:14 | rust-thin-vec | 0.2.17-1 | DEBIAN-CVE-2026-6654 |
| Ubuntu:24.04:LTS | rust-thin-vec | no fix listed | UBUNTU-CVE-2026-6654 |
| Ubuntu:25.10 | rust-thin-vec | no fix listed | UBUNTU-CVE-2026-6654 |
| Ubuntu:26.04:LTS | rust-thin-vec | no fix listed | UBUNTU-CVE-2026-6654 |
| Ubuntu:26.10 | rust-thin-vec | no fix listed | UBUNTU-CVE-2026-6654 |
Affected products (as reported)
Weakness: CWE-415, CWE-416, CWE-1341 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j
- https://access.redhat.com/security/cve/CVE-2026-6654 vdb-entry, x_refsource_REDHAT
- RHBZ#2459689 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6654.json x_sadp-csaf-vex