RUSTSEC-2026-0397
`OutBuffer::around_pos` exposes uninitialized memory
OutBuffer::around_pos accepted a position past the initialized length of a
Vec<u8>. The next streaming call then marked everything before the
position as initialized, so safe code could read stale heap memory between
the vector's previous length and that position.
The flaw was corrected by zero-filling that gap.
What each source reports
OSV No score
`OutBuffer::around_pos` exposes uninitialized memory
OutBuffer::around_pos accepted a position past the initialized length of a
Vec<u8>. The next streaming call then marked everything before the
position as initialized, so safe code could read stale heap memory between
the vector's previous length and that position.
The flaw was corrected by zero-filling that gap.
- Record
RUSTSEC-2026-0397- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
4.0.0 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0397 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.