CVE-2026-6654

5.1 MEDIUM

Published: April 20, 2026 Modified: June 30, 2026

Description

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j

Source: security@mozilla.org

Exploit Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-6654

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2459689

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6654.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

4 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.1 / 10.0

EPSS (Exploit Probability)

0.2%

6th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-415 CWE-416 CWE-1341

Affected Vendors

mozilla

Related CVEs