PkgSeer

Vulnerability RUSTSEC-2026-0395

Unknown

17 days ago

Use-after-free with `CParameter::StableInBuffer`

4.1.0+zstd.1.5.0 - 7.3.0 and 8.0.0 - 8.1.0

Summary

Use-after-free with `CParameter::StableInBuffer`

Details

With CParameter::StableInBuffer(true) (experimental feature), the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flush_stream and end_stream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in between, and freed memory was compressed into the frame. The C library behaves this way since zstd 1.5.4, whether bundled or linked from the system.

The flaw was corrected by refusing to enable the parameter.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

`Seekable` reads a NULL or out-of-bounds seek table

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0396

`OutBuffer::around_pos` exposes uninitialized memory

4.0.0+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0397

`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0398

Use-after-free through `init_using_cdict` and `init_using_ddict`

3.0.0+zstd.1.4.8 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0399

Use-after-free of a dictionary after a one-shot call on a context with an open stream

3.0.1+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0400

View all vulnerabilities for these packages

Impacted packages

zstd-safe

Timeline

Published

17 days ago

Fixed (8.2.0)

16 days ago

Fixed (7.4.0)

1 day ago

Last Modified

4 hours ago