Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0406

Use-after-free when changing a multithreaded context with an unfinished frame

Published Oct 16, 2026 · Updated Nov 2, 2026 · Assigned by RUSTSEC

Description

When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is
left unfinished, its jobs may still be running on the worker threads: the C
library only waits for them when the next frame starts, or when the context
is freed. A session reset makes the context accept changes again in the
meantime, so:

- unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`,
`disable_dictionary`, `init*`, or `reset` with parameters) freed the
dictionary a worker was still compressing against;
- changing `NbWorkers` made the next frame resize the job table before
waiting for the old jobs.

The flaw was corrected by refusing these calls while a multithreaded frame
is unfinished. The new `CCtx::wait_for_workers()` waits for the workers
first.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io zstd-safe >= 0.0.0-0, < 7.4.0 · >= 8.0.0-0, < 8.2.0 7.4.0, 8.2.0 RUSTSEC-2026-0406

References