---
id: CVE-2022-36086
aliases:
  - RUSTSEC-2022-0063
  - GHSA-xg8p-34w2-j49j
title: Multiple vulnerabilities resulting in out-of-bounds writes
summary: Multiple vulnerabilities resulting in out-of-bounds writes
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: linked_list_allocator
product: linked_list_allocator
ecosystem: rust
affected:
  - 'linked_list_allocator >= 0.0.0-0, < 0.10.2'
patched:
  - linked_list_allocator 0.10.2
published: '2022-09-07'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:02.664470642Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0063'
references:
  - url: 'https://crates.io/crates/linked_list_allocator'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0063.html'
  - url: >-
      https://github.com/rust-osdev/linked-list-allocator/commit/013b0758643943e8df5b17bbb495460ff47e8bbf
tags:
  - osv
  - rust
epss: 0.00861
epssPercentile: 0.58338
ingestedAt: '2026-10-13T11:45:30.157Z'
---

## Overview

* The heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to **out-of-bound writes** when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations.
* When calling `Heap::extend` with a size smaller than two `usize`s (e.g., 16 on `x86_64`), the size was erroneously rounded up to the minimum size, which could result in an **out-of-bounds write**.
* Calling `Heap::extend` on an empty heap tried to construct a heap starting at address 0, which is also an **out-of-bounds write**.
  * One specific way to trigger this accidentally is to call `Heap::new` (or a similar constructor) with a heap size that is smaller than two `usize`s. This was treated as an empty heap as well.
* Calling `Heap::extend` on a heap whose size is not a multiple of the size of two `usize`s resulted in unaligned writes. It also left the heap in an unexpected state, which might lead to subsequent issues. We did not find a way to exploit this undefined behavior yet (apart from DoS on platforms that fault on unaligned writes).

## Affected packages

- `linked_list_allocator >= 0.0.0-0, < 0.10.2`

## Remediation

Upgrade to a patched release:

- `linked_list_allocator 0.10.2`