diff --git a/xml/System.Buffers/ArrayPool`1.xml b/xml/System.Buffers/ArrayPool`1.xml index 181bd81cb92..7fedb6e085c 100644 --- a/xml/System.Buffers/ArrayPool`1.xml +++ b/xml/System.Buffers/ArrayPool`1.xml @@ -309,6 +309,9 @@ The array returned by this method may not be zero-initialized. ## Remarks Once a buffer has been returned to the pool, the caller gives up all ownership of the buffer and must not use it. The reference returned from a given call to the method must only be returned using the method once. The default may hold onto the returned buffer in order to rent it again, or it may release the returned buffer if it's determined that the pool already has enough buffers stored. + +> [!IMPORTANT] +> Returning the same array reference twice or continuing to use the array reference after it has been returned is a high-severity security issue. These actions can lead to [double-free](https://cwe.mitre.org/data/definitions/415.html) and [use-after-free](https://cwe.mitre.org/data/definitions/416.html) vulnerabilities, which might result in data corruption, data leaks, and denial of service. ]]>