Use-After-Free and Double-Free in IntoIter::drop when element drop panics

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-6654 · Microsoft / collected KEV context

EUVD-2026-23832

GHSA-xphw-cqx3-667j

RUSTSEC-2026-0103

cve-program · CVE-2026-6654

• https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j

euvd · EUVD-2026-23832

• https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j

nvd · CVE-2026-6654

• https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j
• https://access.redhat.com/security/cve/CVE-2026-6654
• https://bugzilla.redhat.com/show_bug.cgi?id=2459689
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6654.json

osv · GHSA-xphw-cqx3-667j

• https://github.com/mozilla/thin-vec/security/advisories/GHSA-xphw-cqx3-667j
• https://nvd.nist.gov/vuln/detail/CVE-2026-6654
• https://github.com/mozilla/thin-vec
• https://rustsec.org/advisories/RUSTSEC-2026-0103.html

osv · RUSTSEC-2026-0103

• https://crates.io/crates/thin-vec
• https://rustsec.org/advisories/RUSTSEC-2026-0103.html
• https://github.com/mozilla/thin-vec/commit/df64748355222525c344ecd9d2c9f59a662e1678

No related operational record is retained in the current change model.