{"id":"RUSTSEC-2026-0398","title":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","summary":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","severity":"none","vendor":"zstd-safe","product":"zstd-safe","ecosystem":"rust","affected":["zstd-safe >= 7.2.2, < 8.2.0"],"patched":["zstd-safe 8.2.0"],"published":"2026-10-16","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:00:05.092082939Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0398","references":[{"url":"https://crates.io/crates/zstd-safe"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0398.html"},{"url":"https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7"},{"url":"https://github.com/gyscos/zstd-rs/pull/384"}],"tags":["osv","rust"],"ingestedAt":"2026-10-27T16:20:12.103Z","slug":"RUSTSEC-2026-0398","body":"## Overview\n\n`ZSTD_seekable_decompress` shortens the requested length to the end of the\ndata without checking that the offset is before it. For an offset past the\nend, it returns a wrapped-around length without writing anything, and\n`Seekable::decompress` passed that length to `Vec::set_len`.\n\nWith the `seekable` feature, whoever supplies the archive, or chooses the\noffset, can leave the caller's `Vec<u8>` with a length far beyond its\ncapacity. Reading it then discloses neighbouring heap memory, and appending\nto it corrupts memory. Offsets near `u64::MAX` can also hang the call.\n\nThe flaw was corrected by clamping requests to the end of the data, and by\nchecking every count reported by the C library against the buffer capacity.\n\n## Affected packages\n\n- `zstd-safe >= 7.2.2, < 8.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zstd-safe 8.2.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}