{"id":"RUSTSEC-2026-0395","summary":"Use-after-free with `CParameter::StableInBuffer`","details":"With `CParameter::StableInBuffer(true)` (`experimental` feature), the C\nlibrary keeps a pointer to the input of one streaming call and reads from it\nin later calls, including `flush_stream` and `end_stream`, which take no\ninput. An `InBuffer` only borrows its slice for one call, so safe code could\nfree it in between, and freed memory was compressed into the frame. The C\nlibrary behaves this way since zstd 1.5.4, whether bundled or linked from the\nsystem.\n\nThe flaw was corrected by refusing to enable the parameter.","modified":"2026-10-26T14:00:06.388344282Z","published":"2026-10-16T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/zstd-safe"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0395.html"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/pull/384"}],"affected":[{"package":{"name":"zstd-safe","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"8.2.0"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":["zstd_safe::CCtx::set_parameter"]},"affected_functions":null},"database_specific":{"categories":["memory-exposure"],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0395.json"}}],"schema_version":"1.9.0"}