RUSTSEC-2026-0393

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0393

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0393.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0393

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:04Z

Summary

Out-of-bounds read when training a dictionary from inconsistent sample sizes

Details

ZDICT_trainFromBuffer is never told the length of the samples buffer. Before 0.4.10, zstd::dict::from_continuous (initially train_dict) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end.

This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd

Package

Name: zstd; View open source insights on deps.dev
Purl: pkg:cargo/zstd

Affected ranges

Type: SEMVER
Events: Introduced

0.1.1

Fixed

0.4.10

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}