The vulnerability in 'smallbitvec', a growable bit-vector optimized for size in Rust, is due to an integer overflow in capacity calculation between versions 1.0.1 and 2.6.0. This overflow results in allocating less heap memory than needed, causing a heap buffer overflow when the vector grows. Notably, exploitation does not require unsafe Rust code, meaning safe API usage can trigger memory corruption. This flaw is tracked as CWE-122 (Heap-based Buffer Overflow) and CWE-190 (Integer Overflow). The issue is resolved in version 2.6.1.

Successful exploitation can lead to memory corruption, potentially causing application crashes or arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability, with a CVSS vector indicating local attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality (low), integrity (low), and availability (high). No known exploits are reported in the wild.

Upgrade 'smallbitvec' to version 2.6.1 or later, where this vulnerability is fixed. Since this is a library vulnerability, users should update their dependencies accordingly. No vendor advisory is provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version fix information in the description.