Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0393

Out-of-bounds read when training a dictionary from inconsistent sample sizes

Published Oct 16, 2026 · Updated Oct 26, 2026 · Assigned by RUSTSEC

Description

`ZDICT_trainFromBuffer` is never told the length of the samples buffer.
Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called
it directly: up to 0.2.1 without checking the sample sizes against the
buffer at all, and from 0.3.0 with a sum that wraps around when overflow
checks are off, as in release builds. Sizes that do not describe the buffer
made the trainer read past its end.

This requires the sample sizes to come from an untrusted source. From
0.4.10, training goes through zstd-safe, where the same flaw is covered by
the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io zstd >= 0.1.1, < 0.4.10 0.4.10 RUSTSEC-2026-0393

References