CVE-2026-44983: smallbitvec Buffer Overflow Vulnerability

CVE-2026-44983 Overview

CVE-2026-44983 affects smallbitvec, a growable bit-vector library for Rust optimized for size. The vulnerability exists in versions 1.0.1 through 2.6.0. An integer overflow in the internal capacity calculation produces an undersized heap allocation. This allocation triggers a heap buffer overflow reachable through the crate's safe APIs. Memory corruption occurs without any unsafe code on the caller's side, which undermines Rust's memory safety guarantees for downstream consumers. The maintainers fixed the flaw in version 2.6.1. The issue is tracked under [CWE-122: Heap-based Buffer Overflow].

Critical Impact

A safe-API integer overflow in smallbitvec causes undersized heap allocation and heap buffer overflow, enabling memory corruption in any Rust application using vulnerable versions 1.0.1 through 2.6.0.

Affected Products

• smallbitvec crate versions 1.0.1 through 2.6.0
• Rust applications and libraries depending on vulnerable smallbitvec versions
• Servo and downstream consumers of the servo/smallbitvec repository

Discovery Timeline

• 2026-05-26 - CVE-2026-44983 published to the National Vulnerability Database
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44983

Vulnerability Analysis

The vulnerability stems from arithmetic performed during capacity calculation inside smallbitvec. When the crate computes the size of a heap buffer to back a bit-vector, an integer overflow wraps the computed value to a small number. The library then requests a heap allocation sized by that wrapped value. Subsequent writes use the original, larger logical length and exceed the allocated buffer. The result is a heap-based buffer overflow that corrupts adjacent heap memory.

The defect is reachable through the public, safe API surface of the crate. Callers do not need to write unsafe blocks to trigger the condition. This breaks the invariant that pure safe Rust code cannot cause memory unsafety and exposes any dependent application to memory corruption.

Root Cause

The root cause is missing overflow checking in the internal capacity arithmetic. The calculation that translates a requested bit count into a backing-storage allocation size can wrap when the requested value approaches the upper bounds of the integer type. The undersized allocation is then used as if it were correctly sized, producing out-of-bounds heap writes.

Attack Vector

Exploitation requires local access and the ability to influence the size or growth pattern of a smallbitvec instance inside a target process. An attacker who controls inputs that drive bit-vector growth, such as parsed file contents, can trigger the overflow condition. Successful corruption can lead to denial of service through process crash or, depending on heap layout, manipulation of adjacent heap data.

No public proof-of-concept is listed for this CVE, and the issue is not present on the CISA Known Exploited Vulnerabilities catalog. See the GitHub Security Advisory GHSA-97wc-2hqc-cjgr for the maintainer's technical writeup.

Detection Methods for CVE-2026-44983

Indicators of Compromise

• Unexpected process crashes or SIGSEGV signals in Rust binaries that link against smallbitvec
• Heap corruption diagnostics reported by allocators such as jemalloc or glibc malloc when running affected binaries
• Anomalous memory allocation patterns immediately preceding a crash in code paths that grow bit-vectors

Detection Strategies

• Inventory Rust projects and parse Cargo.lock files to enumerate any dependency on smallbitvec at versions 1.0.1 through 2.6.0
• Run cargo audit against repositories to surface the advisory GHSA-97wc-2hqc-cjgr automatically
• Execute affected binaries under AddressSanitizer (ASAN) builds during CI to catch heap out-of-bounds writes before release

Monitoring Recommendations

• Forward application crash telemetry and core dumps to a centralized log pipeline for review
• Alert on repeated abnormal terminations of services that process attacker-influenced data through bit-vector structures
• Track new advisories on the servo/smallbitvec security advisories page

How to Mitigate CVE-2026-44983

Immediate Actions Required

• Update smallbitvec to version 2.6.1 or later in every Rust workspace that consumes the crate
• Rebuild and redeploy any binaries that statically link a vulnerable version
• Run cargo update -p smallbitvec and verify the resolved version in Cargo.lock
• Audit transitive dependencies, since smallbitvec may be pulled in indirectly

Patch Information

The maintainers fixed the integer overflow in smallbitvec version 2.6.1. The patch adds overflow-checked arithmetic to the capacity calculation so the allocation size matches the logical length of the bit-vector. Details are published in the GitHub Security Advisory GHSA-97wc-2hqc-cjgr.

Workarounds

• Constrain external inputs so they cannot drive smallbitvec allocations near the integer-type maximum
• Replace smallbitvec with an alternative bit-vector crate if upgrading is not immediately feasible
• Build affected services with sanitizer tooling enabled in non-production environments to catch exploitation attempts

# Configuration example
# Update the crate in your workspace
cargo update -p smallbitvec --precise 2.6.1

# Verify the resolved version
grep -A1 'name = "smallbitvec"' Cargo.lock

# Scan for known advisories
cargo install cargo-audit
cargo audit