GHSA-mc9m-6fm9-pghc
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.
- Record
GHSA-mc9m-6fm9-pghc- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-362, CWE-416
- Updated
- 2026-11-02
OSV
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.
- Record
GHSA-mc9m-6fm9-pghc- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-362, CWE-416
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zoo-kclPyPI | before 0.3.153 | 0.3.153 |
kcl-libcrates.io | before 0.2.153 | 0.2.153 |
zoo-kclPyPI | before 0.3.153, plus listed versions 0.3.1350.3.1360.3.1370.3.1380.3.139 Show 12 moreShow less0.3.1400.3.1410.3.1420.3.1430.3.1440.3.1450.3.1460.3.1470.3.1480.3.1500.3.1510.3.152 | 0.3.153 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mc9m-6fm9-pghc is a medium vulnerability (CVSS 6.9) in kcl-lib, published August 20, 2026. No source lists public exploit code. Fixed in zoo-kcl 0.3.153.