AIKIDO-2026-601725

archery is vulnerable to Type Confusion

Type Confusion Pre-CVE Published Aug 12, 2026

Medium Risk

This Affects:

archery

0.1.0 - 1.2.2

Fixed in 1.2.3

Are you affected? Scan for Free

TL;DR

The shared pointer kinds RcK, ArcK, and ArcTK erase the element type by transmuting Rc<T>/Arc<T> to Rc<()>/Arc<()> and casting references back, relying on the undocumented memory layout of these repr(Rust) types. Rust does not guarantee layout compatibility between these types, so the conversions are undefined behavior that can lead to invalid pointer interpretation and memory corruption. A related flaw in map_owned can corrupt reference counts when a value's clone implementation panics during unwinding, risking use-after-free or double-free. The fix performs type erasure through into_raw/from_raw via an ErasedPtr and adds RAII write-back so reference counts are restored if a panic occurs.

Who does this affect?

You are affected if you use archery's SharedPointer with the RcK, ArcK, or ArcTK pointer kinds, directly or transitively (for example via rpds). The layout-incompatible Rc/Arc type-erasure runs during ordinary safe use of these kinds, so the undefined behavior is executed unconditionally on affected versions. The concrete reference-count corruption path (use-after-free / double-free) additionally requires calling make_mut/map_owned with a value whose Clone implementation panics while unwinding; whether the transmute miscompiles depends on the compiler's chosen layout. No special or malicious configuration is required to reach the underlying UB.