CVE-2026-6654 | Mozilla thin-vec up to 0.2.15 clear use after free (GHSA-xphw-cqx3-667j / EUVD-2026-23832)

VDB-358299 · CVE-2026-6654 · GHSA-XPHW-CQX3-667J MOZILLA THIN-VEC UP TO 0.2.15 CLEAR USE AFTER FREE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 3.4 $0-$5k 6.90 Summaryinfo A vulnerability marked as critical has been reported in Mozilla thin-vec up to 0.2.15. The impacted element is the function IntoIter::drop/ThinVec::clear. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-6654. There is no exploit available. It is suggested to upgrade the affected component. Detailsinfo A vulnerability classified as problematic has been found in Mozilla thin-vec up to 0.2.15. This affects the function IntoIter::drop/ThinVec::clear. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on availability. The summary by CVE is: Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero. The weakness was shared by Juhyung Son as GHSA-xphw-cqx3-667j. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-6654 since 04/20/2026. The exploitability is told to be easy. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/20/2026). Upgrading to version 0.2.16 eliminates this vulnerability. The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-23832). Productinfo Type Web Browser Vendor Mozilla Name thin-vec Version 0.2.0 0.2.1 0.2.2 0.2.3 0.2.4 0.2.5 0.2.6 0.2.7 0.2.8 0.2.9 0.2.10 0.2.11 0.2.12 0.2.13 0.2.14 0.2.15 License open-source Website Vendor: https://www.mozilla.org/ Product: https://github.com/mozilla/thin-vec/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 3.5 VulDB Meta Temp Score: 3.4 VulDB Base Score: 3.5 VulDB Temp Score: 3.4 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Use after free CWE: CWE-416 / CWE-119 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Partially Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: thin-vec 0.2.16 Timelineinfo 04/20/2026 Advisory disclosed 04/20/2026 +0 days CVE reserved 04/20/2026 +0 days VulDB entry created 04/20/2026 +0 days VulDB entry last update Sourcesinfo Vendor: mozilla.org Product: github.com Advisory: GHSA-xphw-cqx3-667j Researcher: Juhyung Son Status: Confirmed CVE: CVE-2026-6654 (🔒) GCVE (CVE): GCVE-0-2026-6654 GCVE (VulDB): GCVE-100-358299 EUVD: 🔒 Entryinfo Created: 04/20/2026 13:37 Updated: 04/20/2026 16:24 Changes: 04/20/2026 13:37 (58), 04/20/2026 16:24 (1) Complete: 🔍 Cache ID: 99:183:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸