AIKIDO-2026-10916

TL;DR

Affected versions of this package contain a use-after-free flaw in the float deserialization logic, where uint64ToFloatR and uint32ToFloatR return an unsafe.Pointer to a stack-local parameter that becomes invalid once the function returns. This can impact the **float64 and **float32 unmarshal paths, leading to memory corruption, crashes, or unpredictable behavior when crafted input triggers reuse of the dangling pointer. An attacker able to supply malicious serialized data could exploit this condition to induce denial of service or potentially influence application behavior through unsafe memory access.