{"id":"EUVD-2026-23832","enisaUuid":"ddb93bdf-3d29-3b94-9911-60521bb74d82","description":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","datePublished":"Apr 20, 2026, 10:05:52 AM","dateUpdated":"Jul 15, 2026, 12:41:16 AM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","references":"https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j\n","aliases":"CVE-2026-6654\n","assigner":"mozilla","epss":0.17,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"7aae02ac-6b54-36f8-bf20-4e4e86a4a163","vulnerability":{"id":"CVE-2026-6654","description":"Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.","datePublished":"Apr 20, 2026, 10:05:52 AM","dateUpdated":"Jul 15, 2026, 12:41:16 AM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","references":"https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j\n","enisa_id":"EUVD-2026-23832\n","assigner":"mozilla","epss":0.17,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}