Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0396

`Seekable` reads a NULL or out-of-bounds seek table

Published Oct 16, 2026 · Updated Nov 2, 2026 · Assigned by RUSTSEC

Description

`Seekable` did not record whether it was initialized. On a fresh `Seekable`,
or one whose `init_buff()` failed, `decompress`, `offset_to_frame_index` and
`frame_decompressed_size` made the C library read a NULL seek table. After a
failed re-initialization, `decompress` returned data from the refused buffer
using the previous seek table.

Separately, `frame_decompressed_size(num_frames())`, on `Seekable` and
`SeekTable`, read one entry past the end of the seek table.

The flaw was corrected by refusing to use a `Seekable` until an
initialization succeeded, and by checking the frame index.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io zstd-safe >= 7.2.2, < 7.4.0 · >= 8.0.0-0, < 8.2.0 7.4.0, 8.2.0 RUSTSEC-2026-0396

References