{"id":"RUSTSEC-2026-0393","summary":"Out-of-bounds read when training a dictionary from inconsistent sample sizes","details":"`ZDICT_trainFromBuffer` is never told the length of the samples buffer.\nBefore 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called\nit directly: up to 0.2.1 without checking the sample sizes against the\nbuffer at all, and from 0.3.0 with a sum that wraps around when overflow\nchecks are off, as in release builds. Sizes that do not describe the buffer\nmade the trainer read past its end.\n\nThis requires the sample sizes to come from an untrusted source. From\n0.4.10, training goes through zstd-safe, where the same flaw is covered by\nthe zstd-safe advisory for it, fixed in zstd-safe 8.2.0.","modified":"2026-10-26T14:00:04.245510808Z","published":"2026-10-16T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/zstd"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0393.html"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/pull/384"}],"affected":[{"package":{"name":"zstd","ecosystem":"crates.io","purl":"pkg:cargo/zstd"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.1"},{"fixed":"0.4.10"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":[]},"affected_functions":null},"database_specific":{"cvss":null,"informational":"unsound","categories":["memory-exposure"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0393.json"}}],"schema_version":"1.9.0"}