RUSTSEC-2026-0282
Vulnerability from osv_rustsec
Shrinking an AlignedBox<[T]> takes ownership of the buffer out of
self.container with ManuallyDrop::take, destroys the elements past the new
length, and only then commits the new Box back into self.container.
ManuallyDrop::take moves ownership but not the bits, so until that commit
self.container still points at the original buffer.
T::drop runs inside the destruction loop and is user code — T carries no
bound that would exclude a panicking Drop. If it unwinds, the commit is
skipped and self.container is left pointing at the buffer whose tail has
already been destroyed. AlignedBox's own destructor then reconstructs a Box
from that pointer, drops every element again and deallocates — a double free
(CWE-415) / use-after-free (CWE-416) reachable from safe Rust.
Growing the slice destroys nothing and is unaffected, as is
realloc_with_value, which requires T: Copy and therefore a Drop that
cannot run.
Mitigation
Update to 0.3.1.
{
"affected": [
{
"database_specific": {
"categories": [
"memory-corruption"
],
"cvss": null,
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"aligned_box::AlignedBox::realloc_with_default"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "aligned_box",
"purl": "pkg:cargo/aligned_box"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.3.1"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "Shrinking an `AlignedBox\u003c[T]\u003e` takes ownership of the buffer out of\n`self.container` with `ManuallyDrop::take`, destroys the elements past the new\nlength, and only then commits the new `Box` back into `self.container`.\n`ManuallyDrop::take` moves ownership but not the bits, so until that commit\n`self.container` still points at the original buffer.\n\n`T::drop` runs inside the destruction loop and is user code \u2014 `T` carries no\nbound that would exclude a panicking `Drop`. If it unwinds, the commit is\nskipped and `self.container` is left pointing at the buffer whose tail has\nalready been destroyed. `AlignedBox`\u0027s own destructor then reconstructs a `Box`\nfrom that pointer, drops every element again and deallocates \u2014 a double free\n(CWE-415) / use-after-free (CWE-416) reachable from safe Rust.\n\nGrowing the slice destroys nothing and is unaffected, as is\n`realloc_with_value`, which requires `T: Copy` and therefore a `Drop` that\ncannot run.\n\n## Mitigation\n\nUpdate to 0.3.1.",
"id": "RUSTSEC-2026-0282",
"modified": "2026-09-09T10:49:52Z",
"published": "2026-09-09T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/aligned_box"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0282.html"
},
{
"type": "WEB",
"url": "https://github.com/michaellass/aligned_box/pull/6"
}
],
"related": [],
"severity": [],
"summary": "Double free in `AlignedBox\u003c[T]\u003e::realloc_with_default` when an element\u0027s `Drop` panics"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.