RUSTSEC-2026-0402
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
CCtx::try_clone (experimental feature, deprecated) copies tables sized
from the context's applied parameters. Starting a multithreaded frame
(zstdmt feature) replaces those parameters with the workers' without
resizing the context's own tables, so after an abandoned single-threaded
frame, the copy wrote up to 512 KiB past a heap allocation, or read past
one. This became reachable with the bundled zstd 1.5.6.
The flaw was corrected by refusing try_clone (and the unsafe
compress_block) once NbWorkers was set on the context.
What each source reports
OSV No score
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
CCtx::try_clone (experimental feature, deprecated) copies tables sized
from the context's applied parameters. Starting a multithreaded frame
(zstdmt feature) replaces those parameters with the workers' without
resizing the context's own tables, so after an abandoned single-threaded
frame, the copy wrote up to 512 KiB past a heap allocation, or read past
one. This became reachable with the bundled zstd 1.5.6.
The flaw was corrected by refusing try_clone (and the unsafe
compress_block) once NbWorkers was set on the context.
- Record
RUSTSEC-2026-0402- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
4.1.4 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0402 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.