---
id: RUSTSEC-2026-0395
title: 'Use-after-free with `CParameter::StableInBuffer`'
summary: 'Use-after-free with `CParameter::StableInBuffer`'
severity: none
vendor: zstd-safe
product: zstd-safe
ecosystem: rust
affected:
  - 'zstd-safe >= 8.0.0-0, < 8.2.0'
patched:
  - zstd-safe 8.2.0
published: '2026-10-16'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T09:30:03.420559993Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0395'
references:
  - url: 'https://crates.io/crates/zstd-safe'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0395.html'
  - url: >-
      https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65
  - url: 'https://github.com/gyscos/zstd-rs/pull/384'
tags:
  - osv
  - rust
ingestedAt: '2026-10-27T16:20:12.098Z'
---

## Overview

With `CParameter::StableInBuffer(true)` (`experimental` feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including `flush_stream` and `end_stream`, which take no
input. An `InBuffer` only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.

The flaw was corrected by refusing to enable the parameter.

## Affected packages

- `zstd-safe >= 8.0.0-0, < 8.2.0`

## Remediation

Upgrade to a patched release:

- `zstd-safe 8.2.0`