CVE-2026-6654

CVE-2026-6654 is a double-free and use-after-free vulnerability in the thin_vec Rust crate, specifically within the IntoIter::drop and ThinVec::clear functions. The flaw occurs when a panic in ptr::drop_in_place fails to reset the length to zero, potentially allowing memory to be freed twice or accessed after deallocation. Any application or library depending on the thin_vec crate is potentially affected by this vulnerability. The vulnerability carries a CVSS v3.1 score of 5.1 (Medium severity) with local access vector, low attack complexity, and no privilege requirements. The attack vector allows for both confidentiality and integrity impact with no availability impact, though the extremely low EPSS score of 0.000120 suggests minimal real-world exploitation probability compared to other vulnerabilities. There is currently no evidence of active exploitation, and the vulnerability does not appear on the KEV catalog or Hot List. The FAUCET risk score of 40.0 out of 100 indicates moderate concern. Community adoption and patch availability should be assessed, though the low EPSS and lack of public exploitation activity suggest this remains a low-urgency remediation unless the affected crate is critical to your infrastructure.