{"id":"CVE-2026-55406","aliases":["EUVD-2026-44949","GHSA-9pwq-gcrx-wghh"],"status":"published","title":"Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","description":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView\u003cV\u003e type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to \u0026'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as \u0026'static str and \u0026'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00193,"percentile":0.09133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-416"],"published":"2026-07-16T15:54:29Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"crates.io","package":"buffa","fixed_in":["0.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"buffa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"buffa","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]}],"products":[{"vendor":"anthropics","product":"buffa"}],"references":[{"url":"https://github.com/anthropics/buffa/security/advisories/GHSA-9pwq-gcrx-wghh","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/anthropics/buffa/pull/154","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/anthropics/buffa/commit/7dcf50a1a40eca6ed8d6c6dd59f4310aa0d68b0e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/anthropics/buffa/releases/tag/v0.7.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55406","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9pwq-gcrx-wghh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55406.json","tags":["advisory"]},{"url":"https://github.com/anthropics/buffa","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55406","title":"Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","description":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView\u003cV\u003e type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to \u0026'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as \u0026'static str and \u0026'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.","status":"published","published":"2026-07-16T15:54:29.511Z","modified":"2026-07-16T16:47:37.717Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-416"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-44949","description":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView\u003cV\u003e type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to \u0026'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as \u0026'static str and \u0026'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.","status":"published","published":"2026-07-16T15:54:29Z","modified":"2026-07-16T16:47:37Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:19:51.364603Z"}],"ghsa":[{"id":"GHSA-9pwq-gcrx-wghh","title":"Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","description":"A soundness bug in `buffa`'s `OwnedView\u003cV\u003e` allowed safe Rust code to trigger a use-after-free. The `OwnedView::decode` constructor transmuted a borrowed slice to `\u0026'static [u8]`, and the `Deref` implementation exposed the promoted `'static` lifetime on borrowed view fields (such as `\u0026'static str` and `\u0026'static [u8]`) to callers. Because these references appeared to be `'static`, the borrow checker permitted them to outlive the `OwnedView`; once the `OwnedView` was dropped and its backing buffer freed, those references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse — all without any `unsafe` code in the calling application. Users are advised to update to the latest patched version of buffa.\n\nThank you to hackerone.com/suul for reporting this issue.","status":"published","published":"2026-08-28T18:33:58Z","modified":"2026-08-28T18:34:06Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-416"],"updated_at":"2026-11-02T14:41:08.084849Z"}],"nvd":[{"id":"CVE-2026-55406","description":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView\u003cV\u003e type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to \u0026'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as \u0026'static str and \u0026'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.","status":"published","published":"2026-07-16T17:16:57.623Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-416"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-55406","title":"Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","description":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView\u003cV\u003e type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to \u0026'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as \u0026'static str and \u0026'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.","status":"published","published":"2026-07-16T15:54:29.511Z","modified":"2026-10-28T02:30:29.951497579Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-416"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-9pwq-gcrx-wghh","title":"Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","description":"A soundness bug in `buffa`'s `OwnedView\u003cV\u003e` allowed safe Rust code to trigger a use-after-free. The `OwnedView::decode` constructor transmuted a borrowed slice to `\u0026'static [u8]`, and the `Deref` implementation exposed the promoted `'static` lifetime on borrowed view fields (such as `\u0026'static str` and `\u0026'static [u8]`) to callers. Because these references appeared to be `'static`, the borrow checker permitted them to outlive the `OwnedView`; once the `OwnedView` was dropped and its backing buffer freed, those references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse — all without any `unsafe` code in the calling application. Users are advised to update to the latest patched version of buffa.\n\nThank you to hackerone.com/suul for reporting this issue.","status":"published","published":"2026-08-28T18:33:58Z","modified":"2026-08-28T18:45:07.623595565Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-416"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}