RUSTSEC-2026-0396

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0396

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0396.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0396

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

`Seekable` reads a NULL or out-of-bounds seek table

Details

Seekable did not record whether it was initialized. On a fresh Seekable, or one whose init_buff() failed, decompress, offset_to_frame_index and frame_decompressed_size made the C library read a NULL seek table. After a failed re-initialization, decompress returned data from the refused buffer using the previous seek table.

Separately, frame_decompressed_size(num_frames()), on Seekable and SeekTable, read one entry past the end of the seek table.

The flaw was corrected by refusing to use a Seekable until an initialization succeeded, and by checking the frame index.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-safe

Package

Name: zstd-safe; View open source insights on deps.dev
Purl: pkg:cargo/zstd-safe

Affected ranges

Type: SEMVER
Events: Introduced

7.2.2

Fixed

8.2.0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "zstd_safe::seekable::SeekTable::frame_decompressed_size",
            "zstd_safe::seekable::Seekable::decompress",
            "zstd_safe::seekable::Seekable::decompress_frame",
            "zstd_safe::seekable::Seekable::frame_decompressed_size",
            "zstd_safe::seekable::Seekable::offset_to_frame_index"
        ],
        "os":  []
    }
}