---
id: RUSTSEC-2026-0410
title: WebAssembly allocator shim corrupts memory on allocation failure
summary: WebAssembly allocator shim corrupts memory on allocation failure
severity: none
vendor: zstd-sys
product: zstd-sys
ecosystem: rust
affected:
  - 'zstd-sys >= 2.0.9, < 2.1.2'
patched:
  - zstd-sys 2.1.2
published: '2026-10-16'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:00:05.788985783Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0410'
references:
  - url: 'https://crates.io/crates/zstd-sys'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0410.html'
  - url: >-
      https://github.com/gyscos/zstd-rs/commit/165d1625553c236b9700ca794b8a7c51f5d98314
  - url: 'https://github.com/gyscos/zstd-rs/pull/384'
tags:
  - osv
  - rust
ingestedAt: '2026-10-27T16:20:12.120Z'
---

## Overview

On wasm32, zstd-sys provides `malloc` and `free` to the C library through a
shim over Rust's allocator. The shim did not check for allocation failure:
it wrote its size header to address 0 and returned address 4, which the C
library used as a valid buffer. `free(NULL)` also read below address 0.

Whenever the instance cannot grow its memory by what a frame asks for, a
small crafted frame (a 9-byte header declaring a 128 MiB window is enough)
made decompression write decoded data over the bottom of the module's
linear memory, instead of failing. The corruption stays within the wasm
sandbox.

The flaw was corrected by returning NULL on allocation failure or size
overflow, and by making `free(NULL)` a no-op.

## Affected packages

- `zstd-sys >= 2.0.9, < 2.1.2`

## Remediation

Upgrade to a patched release:

- `zstd-sys 2.1.2`