RUSTSEC-2026-0395
Use-after-free with `CParameter::StableInBuffer`
With CParameter::StableInBuffer(true) (experimental feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including flush_stream and end_stream, which take no
input. An InBuffer only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.
The flaw was corrected by refusing to enable the parameter.
What each source reports
OSV No score
Use-after-free with `CParameter::StableInBuffer`
With CParameter::StableInBuffer(true) (experimental feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including flush_stream and end_stream, which take no
input. An InBuffer only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.
The flaw was corrected by refusing to enable the parameter.
- Record
RUSTSEC-2026-0395- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
4.1.0 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0395 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.