{"id":"RUSTSEC-2026-0406","title":"Use-after-free when changing a multithreaded context with an unfinished frame","summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"none","vendor":"zstd-safe","product":"zstd-safe","ecosystem":"rust","affected":["zstd-safe >= 0.0.0-0, < 8.2.0"],"patched":["zstd-safe 8.2.0"],"published":"2026-10-16","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:00:05.095427051Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","references":[{"url":"https://crates.io/crates/zstd-safe"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0406.html"},{"url":"https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734"},{"url":"https://github.com/gyscos/zstd-rs/pull/384"}],"tags":["osv","rust"],"ingestedAt":"2026-10-27T16:20:12.118Z","slug":"RUSTSEC-2026-0406","body":"## Overview\n\nWhen a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is\nleft unfinished, its jobs may still be running on the worker threads: the C\nlibrary only waits for them when the next frame starts, or when the context\nis freed. A session reset makes the context accept changes again in the\nmeantime, so:\n\n- unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`,\n  `disable_dictionary`, `init*`, or `reset` with parameters) freed the\n  dictionary a worker was still compressing against;\n- changing `NbWorkers` made the next frame resize the job table before\n  waiting for the old jobs.\n\nThe flaw was corrected by refusing these calls while a multithreaded frame\nis unfinished. The new `CCtx::wait_for_workers()` waits for the workers\nfirst.\n\n## Affected packages\n\n- `zstd-safe >= 0.0.0-0, < 8.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zstd-safe 8.2.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}