The vulnerability CVE-2026-46690 affects the spearman unbounded-spsc queue library, specifically versions 0.2.0 and prior. The issue arises from the sender::send function performing a pointer-as-value transmute that results in an out-of-bounds read and a fake-Arc drop under concurrent transmit/receive (TX/RX) race conditions. This can cause memory safety issues including use-after-free or double free scenarios. The vulnerability is categorized under multiple CWEs including CWE-125 (Out-of-bounds Read), CWE-415 (Double Free), CWE-704 (Incorrect Type Conversion or Cast), and CWE-787 (Out-of-bounds Write). There are no publicly available patches or official remediation at the time of this report.

The vulnerability can lead to memory corruption due to out-of-bounds reads and improper reference counting (fake-Arc drop) during concurrent operations. This may cause application crashes or undefined behavior, impacting availability and integrity. Confidentiality impact is low, but integrity and availability impacts are rated as high according to the CVSS vector.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a patch is released, avoid using affected versions (<=0.2.0) in environments where concurrent transmit/receive races are possible or consider applying custom mitigations to prevent concurrent access patterns that trigger the issue.