RUSTSEC-2026-0405
Out-of-bounds read with an out-of-range `InBuffer::pos`
InBuffer's fields are public, so safe code can set pos past the end of
src. The position was passed to the C library unchecked, and
ZSTD_seekable_compressStream, unlike the other streaming functions, does
not validate it: it read past the end of the input slice, by up to the
frame size, and compressed that memory into the output.
The flaw was corrected by checking the position before every call into the C library.
What each source reports
OSV No score
Out-of-bounds read with an out-of-range `InBuffer::pos`
InBuffer's fields are public, so safe code can set pos past the end of
src. The position was passed to the C library unchecked, and
ZSTD_seekable_compressStream, unlike the other streaming functions, does
not validate it: it read past the end of the input slice, by up to the
frame size, and compressed that memory into the output.
The flaw was corrected by checking the position before every call into the C library.
- Record
RUSTSEC-2026-0405- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-safecrates.io |
7.2.2 up to 7.4.0, 8.0.0-0 up to 8.2.0 | 7.4.08.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0405 is a vulnerability with no CVSS score yet in zstd-safe, published October 16, 2026. No source lists public exploit code. Fixed in zstd-safe 7.4.0.