RUSTSEC-2026-0397None▾ Sunlit`OutBuffer::around_pos` exposes uninitialized memory
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
OutBuffer::around_pos accepted a position past the initialized length of a
Vec<u8>. The next streaming call then marked everything before the
position as initialized, so safe code could read stale heap memory between
the vector's previous length and that position.
The flaw was corrected by zero-filling that gap.
zstd-safe >= 4.0.0, < 8.2.0Upgrade to a patched release:
zstd-safe 8.2.0Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0406NoneUse-after-free when changing a multithreaded context with an unfinished frame
RUSTSEC-2026-0405NoneOut-of-bounds read with an out-of-range `InBuffer::pos`
RUSTSEC-2026-0404NoneDouble free in `DCtx::try_clone`
RUSTSEC-2026-0403NoneUninitialized memory exposed when streaming decompression of a legacy frame fails
RUSTSEC-2026-0402NoneHeap buffer overflow in `CCtx::try_clone` on a multithreaded context
RUSTSEC-2026-0401NoneOut-of-bounds read in `train_from_buffer` when sample sizes overflow