🛡️ RUSTSEC-2026-0235 — rkyv

Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Shared pointer validation keyed already-validated pointees by their address and

type, but did not include pointer metadata. For unsized pointees, an archive

could therefore contain multiple Rc, Arc, or weak pointers that shared a

data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address

skipped pointee validation. The safe checked rkyv::access API could

consequently return a slice with a forged length, allowing safe indexing to

read out of bounds. The same validation bypass was reachable through checked

deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and

rejects conflicting metadata. The 0.7 series is also affected but is no

longer supported by upstream. Users who process untrusted archives should upgrade

to 0.8.17 or later.