5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46690

CVE-2026-46690: unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race. At time of publication, there are no publicly available patches.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46690

CVE-2026-46690:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
unbounded-spsc	rust	<= 0.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition between the Sender::send and Receiver::drop functions in the unbounded-spsc crate. The core of the issue lies in the Sender::send function, which, under specific race conditions, performs an incorrect pointer transmute. This misuse of unsafe Rust leads to memory corruption, including an out-of-bounds read and a double free. The Receiver::drop function is also identified as a key component, as its execution is necessary to trigger the race condition. The analysis of the advisory and the provided code snippets confirms that these two functions are central to the vulnerability and would be present in any runtime profile during exploitation.

Vulnerable functions

Sender.send

src/lib.rs

This function contains a race condition vulnerability. When a `send` operation races with the dropping of the receiver, the code enters an `unsafe` block that performs an incorrect type transmutation. It transmutes a raw pointer to a `Producer` into a `Consumer` object, which leads to out-of-bounds memory reads and a double free when the fake `Consumer` is dropped. This can cause a program crash or potentially be exploited for arbitrary code execution.

Receiver.drop

src/lib.rs

The `drop` implementation for the `Receiver` is part of the race condition that triggers the vulnerability. When the `Receiver` is dropped, it signals the `Sender` that it is disconnected. If this happens concurrently with a `send` operation, it can cause the `Sender` to execute the vulnerable code path in `Sender::send`. Therefore, this function is a key part of the exploitation process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.