← Database

CVE-2026-6654

MEDIUM CVSS: 5.1 Published: 2026-04-20 Modified: 2026-07-15

Description

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

Affected Platforms

Mozilla Thin-Vec

Weakness Type

CWE-415, CWE-416, CWE-1341

References