Integer Overflow Vulnerability in Smallbitvec for Rust by Servo
CVE-2026-44983

7.3HIGH

Key Information:

Vendor

Servo

Status
Smallbitvec
Vendor
CVE Published:
26 May 2026

What is CVE-2026-44983?

The smallbitvec library, designed for efficient bit-vector management in Rust, has a vulnerability resulting from an integer overflow in the internal capacity calculation. This issue affects versions 1.0.1 to 2.6.0. An attacker may exploit this vulnerability to induce undersized heap allocations, potentially causing heap buffer overflows even when using safe APIs. This flaw allows for memory corruption without requiring unsafe code, posing a significant risk to applications utilizing this library. The issue has been addressed in version 2.6.1.

Affected Version(s)

smallbitvec >= 1.0.1, < 2.6.1

References

https://github.com/servo/smallbitvec/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.