AIKIDO-2026-439418
arrayvec is vulnerable to Double Free
35
Low Risk
This Affects:
arrayvecTL;DR
ArrayVec::extend_from_iter, used by extend(), collect(), and FromIterator, skips writing each element for zero-sized types but still increments the vector length. For a zero-sized type that implements Drop, the moved element is dropped once when the loop iteration ends and again later when the ArrayVec is dropped or cleared. This double drop is undefined behavior that any safe caller can trigger by extending an ArrayVec with such elements. The fix calls mem::forget on the element in the zero-sized case so it is dropped exactly once.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you store a zero-sized type that implements Drop in an ArrayVec populated via extend(), collect(), or FromIterator.
Background info
arrayvec is vulnerable to Double Free in versions 0.7.5 - 0.7.6.
How to fix this
Upgrade the arrayvec library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant