Intel

AIKIDO-2026-439418

arrayvec is vulnerable to Double Free

Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Jun 23, 2026
June 23, 2026

35

CVE Score

Low

Double Free

Are you affected? Scan for Free

TL;DR

ArrayVec::extend_from_iter, used by extend(), collect(), and FromIterator, skips writing each element for zero-sized types but still increments the vector length. For a zero-sized type that implements Drop, the moved element is dropped once when the loop iteration ends and again later when the ArrayVec is dropped or cleared. This double drop is undefined behavior that any safe caller can trigger by extending an ArrayVec with such elements. The fix calls mem::forget on the element in the zero-sized case so it is dropped exactly once.

How do I fix this?

Upgrade the arrayvec library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you store a zero-sized type that implements Drop in an ArrayVec populated via extend(), collect(), or FromIterator.

Package

Versions

0.7.5 - 0.7.6

Fixed in 0.7.7

Background info

arrayvec is vulnerable to Double Free in versions 0.7.5 - 0.7.6.

Get secure today,
quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

No credit card required | Scan results in 32 seconds.

Trusted by 150k+ orgs
  • Revolut
  • n8n
  • Lovable
  • Deel
  • Prove
  • Omnea