—
RUSTSEC-2026-0295
Memory corruption bug on `ApplyResult` type
Details
The `ApplyResult` type contains a raw pointer to a C++ memory object and has a derived `Clone` implementation which creates a reference to this object without incrementing the associated reference counter.
As a result, if an instance of `ApplyResult` is duplicated through `Clone` and both instances are dropped a use-after-free can occur.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/z3
Introduced in:
0.0.0-0Fixed in: 0.21.0Upgrade z3 to 0.21.0 or newer (ecosystem crates.io).