{"vulnerability": "ghsa-q95x-7g78-rccv", "sightings": [{"uuid": "0c5cfa29-0b46-4249-8cc5-8ed8c1e77a5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-q95x-7g78-rccv", "type": "seen", "source": "https://gist.github.com/alon710/e724b6feec120f49892cbfa2764ae8ba", "content": "# GHSA-Q95X-7G78-RCCV: GHSA-Q95X-7G78-RCCV: Safe Rust Memory Corruption via Use-After-Free in oneringbuf Crate\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-08\n> **Full Report:** https://cvereports.com/reports/GHSA-Q95X-7G78-RCCV\n\n## Summary\nA critical Use-After-Free (UAF) memory corruption vulnerability exists in the oneringbuf Rust crate prior to version 0.8.0. The vulnerability allows safe Rust code to instantiate and clone reference wrappers that point to heap-allocated ring buffers. Dropping one wrapper prematurely reclaims the backing memory, leading to dangling pointer references and subsequent Use-After-Free or Double Free states.\n\n## TL;DR\nA public API design flaw in the oneringbuf crate allows safe Rust code to trigger a heap Use-After-Free and Double Free via premature deallocation of shared heap-backed ring buffers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416 (Use After Free)\n- **Attack Vector**: Network\n- **Attack Complexity**: Low\n- **Attack Requirements**: Present (Application using specific public API)\n- **CVSS v4.0**: 6.3 (Medium)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- oneringbuf (Rust crate)\n- **oneringbuf**: < 0.8.0 (Fixed in: `0.8.0`)\n\n## Mitigation\n\n- Upgrade oneringbuf dependency to 0.8.0 or newer\n- Audit dependencies using cargo-audit to ensure vulnerable versions are not transitively imported\n\n**Remediation Steps:**\n1. Open Cargo.toml in the affected Rust project.\n2. Locate the dependency line for oneringbuf.\n3. Modify the version requirement to '^0.8.0'.\n4. Run 'cargo update' to apply the changes.\n5. Verify with 'cargo audit' to ensure the threat is cleared.\n\n## References\n\n- [GitHub Security Advisory GHSA-q95x-7g78-rccv](https://github.com/advisories/GHSA-q95x-7g78-rccv)\n- [RustSec Advisory RUSTSEC-2026-0152](https://rustsec.org/advisories/RUSTSEC-2026-0152.html)\n- [Source Repository](https://github.com/Skilvingr/rust-oneringbuf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-Q95X-7G78-RCCV) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-08T20:42:49.845130Z"}]}