What is CVE-2026-6654?

CVE-2026-6654 is a medium-severity vulnerability in Mozilla Thin-vec, classified under Double Free. CVSS score: 5.1/10. Published 2026-04-20.

How severe is CVE-2026-6654?

Medium severity. CVSS v3 base score is 5.1 out of 10.

Double Free in Mozilla Thin-vec

CVE-2026-6654

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

Vulnerability class: Double Free

EPSS: 0.000 (6.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Mozilla Thin-vec — versions 0.2.16, 0.2.15

Weakness classification (CWE)

CWE-415 — Double Free
CWE-416 — Use After Free

References

security@mozilla.org (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-6654?: CVE-2026-6654 is a medium-severity vulnerability in Mozilla Thin-vec, classified under Double Free. CVSS score: 5.1/10. Published 2026-04-20.
How severe is CVE-2026-6654?: Medium severity. CVSS v3 base score is 5.1 out of 10.