CVE-2026-46690: unbounded_spsc Pointer Transmute OOB Read & Fake-Arc Drop Vulnerability

Technical summary

CVE-2026-46690 is rooted in unsafe pointer transmutation in the sender::send function of unbounded_spsc. The vulnerability manifests as an out-of-bounds (OOB) read and incorrect Arc drop semantics under transmitter/receiver race conditions. By transmuting a pointer as a raw value without proper lifetime or synchronization guarantees, an attacker or malicious sender can trigger memory access violations when the receiver attempts to dereference or manage the purported Arc. The affected code path exists in all versions up to and including 0.2.0. The vulnerability spans CWE-125 (out-of-bounds read), CWE-415 (double-free), CWE-704 (incorrect type casting), and CWE-787 (out-of-bounds write), indicating multiple unsafe memory operations.

Business impact

Applications using unbounded_spsc for inter-process or inter-thread communication face potential confidentiality and availability risks. An attacker with local access and ability to control sender behavior could exfiltrate sensitive data resident in adjacent memory or crash the receiving process. For services relying on this library for core message routing, exploitation could cause unexpected termination or information leaks. The lack of available patches means remediation requires either a version bump from the maintainer or immediate code replacement with an alternative library.

Affected systems

The vulnerability affects spearman unbounded_spsc versions 0.2.0 and prior. Any Rust application or service dependency on this crate in those versions is in scope. The risk is highest for deployments where sender trust is not implicit or where untrusted input can influence sender state.

Exploitability

Exploitation requires local access (AV:L) and a high complexity bar (AC:H), suggesting that triggering the race condition reliably is non-trivial. However, once the race condition is successfully forced, memory corruption is likely. Privilege escalation is not a prerequisite (PR:L indicates low privileges suffice), making it a realistic attack vector for unprivileged local processes or threads communicating via this library. No public proof-of-concept or active exploitation in the wild has been reported to date.

Remediation

At time of publication, the upstream maintainer has not released a patch. The recommended immediate action is to evaluate alternative lock-free queue implementations or to revert to a known-safe message passing mechanism if available. Coordinate with the unbounded_spsc maintainer on patch timelines. If dependency on this crate is unavoidable pending a fix, isolate its use to trusted sender/receiver pairs and reduce concurrent TX/RX scenarios where possible. Long-term remediation requires a patched version release or library replacement.

Patch guidance

No patches are currently available. Monitor the spearman unbounded_spsc repository and crates.io for version updates. When a patched version is released, verify the fix addresses pointer transmutation safety and race-condition handling in sender::send before upgrading. Given the memory-safety nature of the defect, consider adopting a tested alternative such as crossbeam-channel or parking_lot until a vendor patch is thoroughly validated.

Detection guidance

Scan Cargo.lock or Cargo.toml files for dependencies on unbounded_spsc versions ≤0.2.0. Use `cargo audit` with an updated database once CVE-2026-46690 is indexed. At runtime, monitor for unexpected process terminations, memory access violations (SIGSEGV), or unusual memory consumption in applications using this crate. Correlation of crashes with message-passing workload spikes may indicate exploitation. Static analysis tools like clippy and miri should flag unsafe transmute patterns; enable them in CI/CD.

Why prioritize this

Despite a MEDIUM CVSS score (5.8), this vulnerability should be prioritized for immediate assessment. The combination of local accessibility, high-complexity race condition exploitation, and lack of public patches creates a window where detection and remediation are critical. Organizations with unbounded_spsc in their dependency tree must act now to replace or isolate the library. The confidentiality and availability impacts, while not CRITICAL on their own, compound in systems processing sensitive or time-critical data.

Risk score, explained

The CVSS:3.1 score of 5.8 reflects a MEDIUM severity due to: (1) local attack vector, (2) high complexity in reliably triggering the race, and (3) partial impact scope (confidentiality and integrity are limited; availability is high). The vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) indicates the vulnerability is most exploitable by a local, low-privileged user with the ability to sustain concurrent sender/receiver interactions. Organizations with exposed services or multi-tenant environments should treat this as elevated priority.

Frequently asked questions