CVE-2026-46690 Details

A vulnerability exists in the unbounded_spsc crate, specifically in versions through 0.2.0. The issue arises from an unsafe pointer-as-value transmute in the Sender::send method, which creates a fake Consumer<T> that points to incorrect memory. This misalignment causes an out-of-bounds read and a false Arc drop due to a race condition between sending and receiving messages. The vulnerability can be exploited by dropping the receiver while the sender is still active, leading to memory corruption and a segmentation fault.

A suggested patch involves replacing the pointer-as-value transmute with a safe value-level read, using std::ptr::read to obtain the Producer<T> value, and then transmuting it to a Consumer<T> while managing the drop semantics to prevent double-free errors.