RUSTSEC-2026-0396
`Seekable` reads a NULL or out-of-bounds seek table
Seekable did not record whether it was initialized. On a fresh Seekable,
or one whose init_buff() failed, decompress, offset_to_frame_index and
frame_decompressed_size made the C library read a NULL seek table. After a
failed re-initialization, decompress returned data from the refused buffer
using the previous seek table.
Separately, frame_decompressed_size(num_frames()), on Seekable and
SeekTable, read one entry past the end of the seek table.
The flaw was corrected by refusing to use a Seekable until an
initialization succeeded, and by checking the frame index.
What each source reports
OSV No score
`Seekable` reads a NULL or out-of-bounds seek table
Seekable did not record whether it was initialized. On a fresh Seekable,
or one whose init_buff() failed, decompress, offset_to_frame_index and
frame_decompressed_size made the C library read a NULL seek table. After a
failed re-initialization, decompress returned data from the refused buffer
using the previous seek table.
Separately, frame_decompressed_size(num_frames()), on Seekable and
SeekTable, read one entry past the end of the seek table.
The flaw was corrected by refusing to use a Seekable until an
initialization succeeded, and by checking the frame index.
- Record
RUSTSEC-2026-0396- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
7.2.2 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0396 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.