Memory Corruption Vulnerability in z3 Package: ApplyResult Type Issue
Summary
RUSTSEC-2026-0295: Memory corruption bug on ApplyResult type. Affects z3 versions >= 0.0.0-0, < 0.21.0. Fixed in 0.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The z3 package is a Rust library that provides an interface to the Z3 theorem prover, enabling users to perform logical reasoning and verification tasks. It is widely used in various applications, including formal verification, program analysis, and constraint solving. However, the package has a vulnerability related to the ApplyResult type, which can lead to memory corruption if not addressed.
Vulnerability Detail
The vulnerability arises from the ApplyResult type containing a raw pointer to a C++ memory object. The derived Clone implementation creates a reference to this object without incrementing the associated reference counter. Consequently, if an instance of ApplyResult is duplicated using Clone and both instances are subsequently dropped, a use-after-free condition can occur, potentially leading to memory corruption and undefined behavior in the application.
How To Fix
Minimum fixed version
0.21.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to update to the patched version as soon as possible to mitigate the risk.
Conclusion
The z3 package has a critical memory corruption vulnerability related to the ApplyResult type, which can lead to severe consequences if not addressed. It is essential to update to version 0.21.0 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for z3 →
FAQ
The vulnerability is a memory corruption issue caused by improper handling of raw pointers in the ApplyResult type, leading to potential use-after-free scenarios.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Cargo.lock file without any signup.
If exploited, this vulnerability can lead to memory corruption, causing crashes or unpredictable behavior in applications that utilize the z3 package.
Yes, the memory corruption caused by this vulnerability could potentially lead to data loss or corruption, depending on how the application manages memory.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version to ensure the security and stability of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for z3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
