PkgSeer

Vulnerability RUSTSEC-2026-0405

Unknown

17 days ago

Out-of-bounds read with an out-of-range `InBuffer::pos`

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0

Summary

Out-of-bounds read with an out-of-range `InBuffer::pos`

Details

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTD_seekable_compressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and compressed that memory into the output.

The flaw was corrected by checking the position before every call into the C library.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Use-after-free with `CParameter::StableInBuffer`

4.1.0+zstd.1.5.0 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0395

`Seekable` reads a NULL or out-of-bounds seek table

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0396

`OutBuffer::around_pos` exposes uninitialized memory

4.0.0+zstd.1.4.9 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0397

`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

7.2.2 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0398

Use-after-free through `init_using_cdict` and `init_using_ddict`

3.0.0+zstd.1.4.8 - 7.3.0 and 8.0.0 - 8.1.0 RUSTSEC-2026-0399

View all vulnerabilities for these packages

Impacted packages

zstd-safe

Timeline

Published

17 days ago

Fixed (8.2.0)

16 days ago

Fixed (7.4.0)

1 day ago

Last Modified

4 hours ago