Vulnerability RUSTSEC-2026-0402
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
17 days ago
October 16, 2026 at 12:00 PM UTC
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
4.1.4+zstd.1.5.2 - 7.3.0 and 8.0.0 - 8.1.0
4.1.4+zstd.1.5.2 - 7.3.0 and 8.0.0 - 8.1.0
Summary
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
Details
CCtx::try_clone (experimental feature, deprecated) copies tables sized from the context's applied parameters. Starting a multithreaded frame (zstdmt feature) replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wrote up to 512 KiB past a heap allocation, or read past one. This became reachable with the bundled zstd 1.5.6.
The flaw was corrected by refusing try_clone (and the unsafe compress_block) once NbWorkers was set on the context.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
17 days ago
Use-after-free with `CParameter::StableInBuffer`
4.1.0+zstd.1.5.0 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0395
4.1.0+zstd.1.5.0 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0395
Unknown
17 days ago
`Seekable` reads a NULL or out-of-bounds seek table
7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0396
7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0396
Unknown
17 days ago
`OutBuffer::around_pos` exposes uninitialized memory
4.0.0+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0397
4.0.0+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0397
Unknown
17 days ago
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0398
7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0398
Unknown
17 days ago
Use-after-free through `init_using_cdict` and `init_using_ddict`
3.0.0+zstd.1.4.8 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0399
3.0.0+zstd.1.4.8 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0399
Impacted packages
Timeline
Published
17 days ago
October 16, 2026 at 12:00 PM UTC
Fixed (8.2.0)
16 days ago
October 16, 2026 at 04:59 PM UTC
Fixed (7.4.0)
1 day ago
November 01, 2026 at 02:11 PM UTC
Last Modified
4 hours ago
November 02, 2026 at 09:30 AM UTC