Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0001

Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM

Published Jan 5, 2026 · Updated Jan 6, 2026 · Assigned by RUSTSEC

Description

The `SharedPointer::alloc` implementation for `sync::Arc<T>` and `rc::Rc<T>` in `rkyv/src/impls/alloc/rc/atomic.rs` (and `rc.rs`) does not check if the allocator returns a null pointer on OOM (Out of Memory).

This null pointer can flow through to `SharedPointer::from_value`, which calls `Box::from_raw(ptr)` with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as `rkyv::from_bytes` or `rkyv::deserialize_using`) if an OOM condition occurs during the allocation of the shared pointer.

The issue is reachable through safe code and violates Rust's safety guarantees.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io rkyv >= 0.0.0-0, < 0.7.46 · >= 0.8.0, < 0.8.13 0.7.46, 0.8.13 RUSTSEC-2026-0001

References