Double-Free Vulnerability in ThinVec from Mozilla
CVE-2026-6654

5.1MEDIUM

Key Information:

Vendor

Mozilla
Status
Thin-vec
Vendor
CVE Published:
20 April 2026

What is CVE-2026-6654?

A double-free and potential Use-After-Free vulnerability exists within the IntoIter::drop and ThinVec::clear functions of the ThinVec crate. An erroneous panic in ptr::drop_in_place can lead to skipping the length reset, which causes unexpected behavior and could lead to application instability. Developers using this crate should take this issue seriously as it may result in crashes and unpredictable states in applications that rely on ThinVec.

Affected Version(s)

thin-vec 0.2.16

References

https://github.com/mozilla/thin-vec/security/advisories/G...

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juhyung Son
.