{"id":"RUSTSEC-2026-0398","summary":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","details":"`ZSTD_seekable_decompress` shortens the requested length to the end of the\ndata without checking that the offset is before it. For an offset past the\nend, it returns a wrapped-around length without writing anything, and\n`Seekable::decompress` passed that length to `Vec::set_len`.\n\nWith the `seekable` feature, whoever supplies the archive, or chooses the\noffset, can leave the caller's `Vec\u003cu8\u003e` with a length far beyond its\ncapacity. Reading it then discloses neighbouring heap memory, and appending\nto it corrupts memory. Offsets near `u64::MAX` can also hang the call.\n\nThe flaw was corrected by clamping requests to the end of the data, and by\nchecking every count reported by the C library against the buffer capacity.","modified":"2026-10-26T14:00:05.092082939Z","published":"2026-10-16T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/zstd-safe"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0398.html"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/pull/384"}],"affected":[{"package":{"name":"zstd-safe","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.2"},{"fixed":"8.2.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"os":[],"functions":["zstd_safe::seekable::AdvancedSeekable::decompress","zstd_safe::seekable::Seekable::decompress"]}},"database_specific":{"cvss":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0398.json","informational":null,"categories":["memory-exposure","memory-corruption"]}}],"schema_version":"1.9.0"}