Intel

AIKIDO-2026-10943

io-event is vulnerable to Use After Free

Use After Free Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Yesterday

68

Medium Risk

This Affects:

RUBYio-event
0.0.1 - 1.15.1
Fixed in 1.16.0
Are you affected? Scan for Free

TL;DR

The native io-event extension keeps worker thread references that can go stale when Ruby compacts the heap, leading to use-after-free if the pool later uses those pointers. Internal selector and array allocations used raw libc allocators with debug-only assert checks, so release builds could dereference NULL and crash the VM when memory is exhausted instead of raising an exception. The patch adds GC compaction callbacks, movable marking, write barriers for WorkerPool, and switches selector internals to Ruby's xmalloc family so allocation failure is handled safely.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

io-event is vulnerable to Use After Free in versions 0.0.1 - 1.15.1.

How to fix this

Upgrade the io-event library to the patch version.