RUSTSEC-2026-0393
Out-of-bounds read when training a dictionary from inconsistent sample sizes
ZDICT_trainFromBuffer is never told the length of the samples buffer.
Before 0.4.10, zstd::dict::from_continuous (initially train_dict) called
it directly: up to 0.2.1 without checking the sample sizes against the
buffer at all, and from 0.3.0 with a sum that wraps around when overflow
checks are off, as in release builds. Sizes that do not describe the buffer
made the trainer read past its end.
This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.
What each source reports
OSV No score
Out-of-bounds read when training a dictionary from inconsistent sample sizes
ZDICT_trainFromBuffer is never told the length of the samples buffer.
Before 0.4.10, zstd::dict::from_continuous (initially train_dict) called
it directly: up to 0.2.1 without checking the sample sizes against the
buffer at all, and from 0.3.0 with a sum that wraps around when overflow
checks are off, as in release builds. Sizes that do not describe the buffer
made the trainer read past its end.
This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.
- Record
RUSTSEC-2026-0393- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstdcrates.io |
0.1.1 up to 0.4.10 | 0.4.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0393 is a vulnerability with no CVSS score yet in zstd, published October 16, 2026. No source lists public exploit code. Fixed in zstd 0.4.10.