RUSTSEC-2026-0401
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
ZDICT_trainFromBuffer is never told the length of the samples buffer, so
train_from_buffer checked that the sample sizes add up to it. With
overflow checks off, as in release builds, that sum wrapped around: sizes
totalling 2^64 plus the buffer length passed the check, and the trainer read
past the end of the buffer. zstd::dict::from_continuous relies on this
check from zstd 0.4.10; older versions of zstd had their own, covered by a
separate advisory.
This requires the sample sizes to come from an untrusted source. The flaw was corrected by summing the sizes with overflow checks.
What each source reports
OSV No score
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
ZDICT_trainFromBuffer is never told the length of the samples buffer, so
train_from_buffer checked that the sample sizes add up to it. With
overflow checks off, as in release builds, that sum wrapped around: sizes
totalling 2^64 plus the buffer length passed the check, and the trainer read
past the end of the buffer. zstd::dict::from_continuous relies on this
check from zstd 0.4.10; older versions of zstd had their own, covered by a
separate advisory.
This requires the sample sizes to come from an untrusted source. The flaw was corrected by summing the sizes with overflow checks.
- Record
RUSTSEC-2026-0401- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
0.0.0-0 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0401 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.