RUSTSEC-2026-0410

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0410

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0410.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0410

Published

2026-10-16T12:00:00Z

Modified

2026-10-26T14:00:05Z

Summary

WebAssembly allocator shim corrupts memory on allocation failure

Details

On wasm32, zstd-sys provides malloc and free to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. free(NULL) also read below address 0.

Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox.

The flaw was corrected by returning NULL on allocation failure or size overflow, and by making free(NULL) a no-op.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / zstd-sys

Package

Name: zstd-sys; View open source insights on deps.dev
Purl: pkg:cargo/zstd-sys

Affected ranges

Type: SEMVER
Events: Introduced

2.0.9

Fixed

2.1.2

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [
            "wasm32"
        ],
        "functions":  [],
        "os":  []
    }
}