{"id":"RUSTSEC-2026-0397","summary":"`OutBuffer::around_pos` exposes uninitialized memory","details":"`OutBuffer::around_pos` accepted a position past the initialized length of a\n`Vec\u003cu8\u003e`. The next streaming call then marked everything before the\nposition as initialized, so safe code could read stale heap memory between\nthe vector's previous length and that position.\n\nThe flaw was corrected by zero-filling that gap.","modified":"2026-10-26T14:00:05.089587004Z","published":"2026-10-16T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/zstd-safe"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0397.html"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/commit/5827de2459b8ac430e87e860f00c7f3c13023833"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/pull/384"}],"affected":[{"package":{"name":"zstd-safe","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"8.2.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"os":[],"functions":["zstd_safe::OutBuffer::around_pos"]}},"database_specific":{"categories":["memory-exposure"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0397.json","cvss":null,"informational":"unsound"}}],"schema_version":"1.9.0"}