Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0395

Use-after-free with `CParameter::StableInBuffer`

Published Oct 16, 2026 · Updated Nov 2, 2026 · Assigned by RUSTSEC

Description

With `CParameter::StableInBuffer(true)` (`experimental` feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including `flush_stream` and `end_stream`, which take no
input. An `InBuffer` only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.

The flaw was corrected by refusing to enable the parameter.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io zstd-safe >= 4.1.0, < 7.4.0 · >= 8.0.0-0, < 8.2.0 7.4.0, 8.2.0 RUSTSEC-2026-0395

References