Vulnerability-Lookup

CVE-2026-44983 (GCVE-0-2026-44983)

Vulnerability from cvelistv5 – Published: 2026-05-26 21:38 – Updated: 2026-05-27 12:45

Title

smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow

Summary

smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-27 12:45 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/servo/smallbitvec/security/adv…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
servo	smallbitvec	Affected: >= 1.0.1, < 2.6.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44983",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:45:06.921929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:45:15.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "smallbitvec",
          "vendor": "servo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.1, \u003c 2.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T21:38:13.753Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
        }
      ],
      "source": {
        "advisory": "GHSA-97wc-2hqc-cjgr",
        "discovery": "UNKNOWN"
      },
      "title": "smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44983",
    "datePublished": "2026-05-26T21:38:13.753Z",
    "dateReserved": "2026-05-08T16:23:33.264Z",
    "dateUpdated": "2026-05-27T12:45:15.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44983",
      "date": "2026-09-24",
      "epss": "0.00158",
      "percentile": "0.04168"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "smallbitvec",
                "vendor": "servo",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0.1, \u003c 2.6.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1."
          },
          {
            "lang": "es",
            "value": "smallbitvec es un vector de bits redimensionable para Rust, optimizado para el tama\u00f1o. De 1.0.1 a 2.6.0, un desbordamiento de entero en el c\u00e1lculo interno de capacidad de smallbitvec puede conducir a una asignaci\u00f3n de memoria en el heap de tama\u00f1o insuficiente, lo que resulta en un desbordamiento de b\u00fafer en el heap \u00fanicamente a trav\u00e9s de APIs seguras. Esto permite la corrupci\u00f3n de memoria sin requerir c\u00f3digo inseguro por parte del llamador. Esta vulnerabilidad est\u00e1 corregida en 2.6.1."
          }
        ],
        "id": "CVE-2026-44983",
        "lastModified": "2026-07-24T12:10:00.210",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-44983",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:45:06.921929Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-26T22:16:43.440",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-122"
              },
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-06T00:43:34+00:00",
      "cve": "CVE-2026-44983",
      "id": "CVE-2026-44983",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44983.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-44983",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-27T12:45:06.921929Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-27T12:44:58.323Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "smallbitvec",
              "vendor": "servo",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0.1, \u003c 2.6.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-190",
                  "description": "CWE-190: Integer Overflow or Wraparound",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-26T21:38:13.753Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
            }
          ],
          "source": {
            "advisory": "GHSA-97wc-2hqc-cjgr",
            "discovery": "UNKNOWN"
          },
          "title": "smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-44983",
        "datePublished": "2026-05-26T21:38:13.753Z",
        "dateReserved": "2026-05-08T16:23:33.264Z",
        "dateUpdated": "2026-05-26T21:38:13.753Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44983

Vulnerability from fkie_nvd - Published: 2026-05-26 22:16 - Updated: 2026-07-24 12:10

Severity

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "smallbitvec",
          "vendor": "servo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.1, \u003c 2.6.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1."
    },
    {
      "lang": "es",
      "value": "smallbitvec es un vector de bits redimensionable para Rust, optimizado para el tama\u00f1o. De 1.0.1 a 2.6.0, un desbordamiento de entero en el c\u00e1lculo interno de capacidad de smallbitvec puede conducir a una asignaci\u00f3n de memoria en el heap de tama\u00f1o insuficiente, lo que resulta en un desbordamiento de b\u00fafer en el heap \u00fanicamente a trav\u00e9s de APIs seguras. Esto permite la corrupci\u00f3n de memoria sin requerir c\u00f3digo inseguro por parte del llamador. Esta vulnerabilidad est\u00e1 corregida en 2.6.1."
    }
  ],
  "id": "CVE-2026-44983",
  "lastModified": "2026-07-24T12:10:00.210",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44983",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-27T12:45:06.921929Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-26T22:16:43.440",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        },
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-97WC-2HQC-CJGR

Vulnerability from github – Published: 2026-05-09 00:02 – Updated: 2026-06-08 23:35

Summary

smallbitvec: Integer overflow in safe API leads to heap buffer overflow

Details

Summary

An integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller.

Details

The issue originates from unchecked arithmetic in the internal helper function responsible for computing the required buffer size:

(cap + bits_per_storage() - 1) / bits_per_storage()

When cap is close to usize::MAX, the addition:

cap + bits_per_storage() - 1

can overflow in release builds and wrap around due to Rust’s default wrapping semantics for integer overflow in optimized builds.

As a result: - buffer_len(cap) may return a value significantly smaller than required. - The backing storage is allocated with insufficient size. - Internal metadata (logical length/capacity) reflects a much larger size than the actual allocation.

Subsequent safe API calls (e.g., set, push, reserve) rely on this corrupted metadata and perform index computations that assume sufficient backing storage. These operations eventually reach unsafe internal code paths (e.g., pointer arithmetic and unchecked indexing), leading to out-of-bounds memory access.

Summary of the issue: integer overflow → undersized allocation → inconsistent metadata (len/cap vs actual buffer) → unsafe internal access using corrupted metadata → heap buffer overflow (UB)

PoC

PoC 1: Out-of-bounds write via `from_elem`

#![forbid(unsafe_code)]

use smallbitvec::SmallBitVec;

fn main() {
    // Triggers overflow in buffer_len(cap)
    let mut v = SmallBitVec::from_elem(usize::MAX, false);

    // Logical length is large, but backing storage is undersized
    // This leads to out-of-bounds write in unsafe internals
    v.set(0, true);
}

PoC 2: Overflow via `reserve`

#![forbid(unsafe_code)]

use smallbitvec::SmallBitVec;

fn main() {
    let mut v = SmallBitVec::new();
    v.push(true);

    // Triggers overflow in capacity computation
    v.reserve(usize::MAX - 10);
}

Impact

Heap buffer overflow via safe API only
ASAN-observable heap-buffer-overflow
Undefined Behavior detectable with Miri (e.g., out-of-bounds indexing due to corrupted metadata)

Tested on

rustc 1.96.0-nightly (9602bda1d 2026-04-05)
Target: x86_64-unknown-linux-gnu
Build: release
ASAN: RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release
Miri: cargo +nightly miri run --release

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "smallbitvec"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.1"
            },
            {
              "last_affected": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122",
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-09T00:02:47Z",
    "nvd_published_at": "2026-05-26T22:16:43Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn integer overflow in the internal capacity calculation of `smallbitvec` can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring `unsafe` code from the caller.\n\n### Details\nThe issue originates from unchecked arithmetic in the internal helper function responsible for computing the required buffer size:\n\n```\n(cap + bits_per_storage() - 1) / bits_per_storage()\n```\n\nWhen `cap` is close to `usize::MAX`, the addition:\n\n```\ncap + bits_per_storage() - 1\n```\n\ncan overflow in release builds and wrap around due to Rust\u2019s default wrapping semantics for integer overflow in optimized builds.\n\nAs a result:\n- `buffer_len(cap)` may return a value significantly smaller than required.\n- The backing storage is allocated with insufficient size.\n- Internal metadata (logical length/capacity) reflects a much larger size than the actual allocation.\n\nSubsequent safe API calls (e.g., `set`, `push`, `reserve`) rely on this corrupted metadata and perform index computations that assume sufficient backing storage. These operations eventually reach unsafe internal code paths (e.g., pointer arithmetic and unchecked indexing), leading to out-of-bounds memory access.\n\nSummary of the issue:\ninteger overflow\n\u2192 undersized allocation\n\u2192 inconsistent metadata (len/cap vs actual buffer)\n\u2192 unsafe internal access using corrupted metadata\n\u2192 heap buffer overflow (UB)\n### PoC\n#### PoC 1: Out-of-bounds write via `from_elem`\n```rust\n#![forbid(unsafe_code)]\n\nuse smallbitvec::SmallBitVec;\n\nfn main() {\n    // Triggers overflow in buffer_len(cap)\n    let mut v = SmallBitVec::from_elem(usize::MAX, false);\n\n    // Logical length is large, but backing storage is undersized\n    // This leads to out-of-bounds write in unsafe internals\n    v.set(0, true);\n}\n```\n#### PoC 2: Overflow via `reserve`\n```rust\n#![forbid(unsafe_code)]\n\nuse smallbitvec::SmallBitVec;\n\nfn main() {\n    let mut v = SmallBitVec::new();\n    v.push(true);\n\n    // Triggers overflow in capacity computation\n    v.reserve(usize::MAX - 10);\n}\n```\n\n### Impact\n- Heap buffer overflow via safe API only\n- ASAN-observable heap-buffer-overflow\n- Undefined Behavior detectable with Miri (e.g., out-of-bounds indexing due to corrupted metadata)\n\n### Tested on\n- rustc 1.96.0-nightly (9602bda1d 2026-04-05)\n- Target: x86_64-unknown-linux-gnu\n- Build: release\n- ASAN: `RUSTFLAGS=\"-Z sanitizer=address\" cargo +nightly run --release`\n- Miri: `cargo +nightly miri run --release`",
  "id": "GHSA-97wc-2hqc-cjgr",
  "modified": "2026-06-08T23:35:08Z",
  "published": "2026-05-09T00:02:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44983"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/servo/smallbitvec"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "smallbitvec: Integer overflow in safe API leads to heap buffer overflow"
}

UBUNTU-CVE-2026-44983 (CVE-2026-44983)

Vulnerability from osv_ubuntu – Published: 2026-05-26 22:16 – Updated: 2026-05-26 22:16 – Source website

Details

Severity

7.3 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-44983	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-44983	REPORT
	https://github.com/servo/smallbitvec/security/adv…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-smallbitvec-dev",
            "binary_version": "2.5.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "rust-smallbitvec",
        "purl": "pkg:deb/ubuntu/rust-smallbitvec@2.5.1-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-smallbitvec-dev",
            "binary_version": "2.5.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rust-smallbitvec",
        "purl": "pkg:deb/ubuntu/rust-smallbitvec@2.5.1-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-smallbitvec-dev",
            "binary_version": "2.5.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "rust-smallbitvec",
        "purl": "pkg:deb/ubuntu/rust-smallbitvec@2.5.1-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-smallbitvec-dev",
            "binary_version": "2.5.1-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rust-smallbitvec",
        "purl": "pkg:deb/ubuntu/rust-smallbitvec@2.5.1-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.1-1",
        "2.5.1-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1.",
  "id": "UBUNTU-CVE-2026-44983",
  "modified": "2026-05-26T22:16:00Z",
  "published": "2026-05-26T22:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44983"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44983"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/servo/smallbitvec/security/advisories/GHSA-97wc-2hqc-cjgr"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-44983"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-44983 (GCVE-0-2026-44983)

FKIE_CVE-2026-44983

GHSA-97WC-2HQC-CJGR

Summary

Details

PoC

PoC 1: Out-of-bounds write via from_elem

PoC 2: Overflow via reserve

Impact

Tested on

UBUNTU-CVE-2026-44983 (CVE-2026-44983)

Tags

Sightings

Nomenclature

Related by attack behaviour

PoC 1: Out-of-bounds write via `from_elem`

PoC 2: Overflow via `reserve`