RUSTSEC-2026-0398None▾ Sunlit`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
ZSTD_seekable_decompress shortens the requested length to the end of the
data without checking that the offset is before it. For an offset past the
end, it returns a wrapped-around length without writing anything, and
Seekable::decompress passed that length to Vec::set_len.
With the seekable feature, whoever supplies the archive, or chooses the
offset, can leave the caller's Vec<u8> with a length far beyond its
capacity. Reading it then discloses neighbouring heap memory, and appending
to it corrupts memory. Offsets near u64::MAX can also hang the call.
The flaw was corrected by clamping requests to the end of the data, and by checking every count reported by the C library against the buffer capacity.
zstd-safe >= 7.2.2, < 8.2.0Upgrade to a patched release:
zstd-safe 8.2.0Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0406NoneUse-after-free when changing a multithreaded context with an unfinished frame
RUSTSEC-2026-0405NoneOut-of-bounds read with an out-of-range `InBuffer::pos`
RUSTSEC-2026-0404NoneDouble free in `DCtx::try_clone`
RUSTSEC-2026-0403NoneUninitialized memory exposed when streaming decompression of a legacy frame fails
RUSTSEC-2026-0402NoneHeap buffer overflow in `CCtx::try_clone` on a multithreaded context
RUSTSEC-2026-0401NoneOut-of-bounds read in `train_from_buffer` when sample sizes overflow