RUSTSEC-2026-0393None▾ SunlitOut-of-bounds read when training a dictionary from inconsistent sample sizes
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
ZDICT_trainFromBuffer is never told the length of the samples buffer.
Before 0.4.10, zstd::dict::from_continuous (initially train_dict) called
it directly: up to 0.2.1 without checking the sample sizes against the
buffer at all, and from 0.3.0 with a sum that wraps around when overflow
checks are off, as in release builds. Sizes that do not describe the buffer
made the trainer read past its end.
This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.
zstd >= 0.1.1, < 0.4.10Upgrade to a patched release:
zstd 0.4.10Connected by shared product, vendor, weakness, or advisory.