smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow
Priority HIGH 65CWE-122Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00151 4th percentileScored 2026-11-07
Fix Partial smallbitvec (servo): 2.6.1Red Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| servo | smallbitvec | 1.0.1 to before 2.6.1 | 2.6.1 | Patch available | CNA |
| — | smallbitvec (crates.io) | 1.0.1 – 2.6.0 | — | No fix listed | GHSA-97wc-2hqc-cjgr |
- smallbitvec Vendorservo Affected 1.0.1 to before 2.6.1 Fixed in 2.6.1 Patch available CNA
- smallbitvec (crates.io) Vendor— Affected 1.0.1 – 2.6.0 Fixed in — No fix listed GHSA-97wc-2hqc-cjgr
Remediation
- Fix · CNA smallbitvec (servo) Fixed in 2.6.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44983
- 2026-10-03 Alias added: GHSA-97wc-2hqc-cjgr
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
More servo vulnerabilities
- TI-2024-11338 idna accepts Punycode labels that do not produce any non-ASCII when decoded CVSS 4.0MEDIUM 5.1
- TI-2019-11654 An issue was discovered in the smallvec crate before 0.6.10 for Rust. CVSS 3.0CRITICAL 9.8
- TI-2019-11651 An issue was discovered in the smallvec crate before 0.6.10 for Rust. CVSS 3.0CRITICAL 9.8
- TI-2018-14953 An issue was discovered in the smallvec crate before 0.6.3 for Rust. CVSS 3.0CRITICAL 9.8
- TI-2021-07911 An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. CVSS 3.1CRITICAL 9.8
- TI-2018-15250 An issue was discovered in the smallvec crate before 0.6.13 for Rust. CVSS 3.1HIGH 7.5
Sources
- CVE-2026-44983 · CVE Program
- CVE-2026-44983 · NVD
- FIRST EPSS
- GHSA-97wc-2hqc-cjgr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-44983 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences