{"id":"RUSTSEC-2026-0396","title":"`Seekable` reads a NULL or out-of-bounds seek table","summary":"`Seekable` reads a NULL or out-of-bounds seek table","severity":"none","vendor":"zstd-safe","product":"zstd-safe","ecosystem":"rust","affected":["zstd-safe >= 8.0.0-0, < 8.2.0"],"patched":["zstd-safe 8.2.0"],"published":"2026-10-16","updated":"2026-11-02","sourceUpdated":"2026-11-02T09:30:03.400899521Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0396","references":[{"url":"https://crates.io/crates/zstd-safe"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0396.html"},{"url":"https://github.com/gyscos/zstd-rs/commit/a9626069d6f2e90b782b8f627f57a361cfe8ef85"},{"url":"https://github.com/gyscos/zstd-rs/pull/384"}],"tags":["osv","rust"],"ingestedAt":"2026-10-27T16:20:12.100Z","slug":"RUSTSEC-2026-0396","body":"## Overview\n\n`Seekable` did not record whether it was initialized. On a fresh `Seekable`,\nor one whose `init_buff()` failed, `decompress`, `offset_to_frame_index` and\n`frame_decompressed_size` made the C library read a NULL seek table. After a\nfailed re-initialization, `decompress` returned data from the refused buffer\nusing the previous seek table.\n\nSeparately, `frame_decompressed_size(num_frames())`, on `Seekable` and\n`SeekTable`, read one entry past the end of the seek table.\n\nThe flaw was corrected by refusing to use a `Seekable` until an\ninitialization succeeded, and by checking the frame index.\n\n## Affected packages\n\n- `zstd-safe >= 8.0.0-0, < 8.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zstd-safe 8.2.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}