Description
The `ApplyResult` type contains a raw pointer to a C++ memory object and has a derived `Clone` implementation which creates a reference to this object without incrementing the associated reference counter.
As a result, if an instance of `ApplyResult` is duplicated through `Clone` and both instances are dropped a use-after-free can occur.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | z3 | >= 0.0.0-0, < 0.21.0 | 0.21.0 | RUSTSEC-2026-0295 |