{"id":"RUSTSEC-2026-0401","summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","details":"`ZDICT_trainFromBuffer` is never told the length of the samples buffer, so\n`train_from_buffer` checked that the sample sizes add up to it. With\noverflow checks off, as in release builds, that sum wrapped around: sizes\ntotalling 2^64 plus the buffer length passed the check, and the trainer read\npast the end of the buffer. `zstd::dict::from_continuous` relies on this\ncheck from zstd 0.4.10; older versions of zstd had their own, covered by a\nseparate advisory.\n\nThis requires the sample sizes to come from an untrusted source. The flaw\nwas corrected by summing the sizes with overflow checks.","modified":"2026-10-26T14:00:04.231502512Z","published":"2026-10-16T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/zstd-safe"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0401.html"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f"},{"type":"WEB","url":"https://github.com/gyscos/zstd-rs/pull/384"}],"affected":[{"package":{"name":"zstd-safe","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"8.2.0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["zstd_safe::train_from_buffer"],"arch":[]},"affected_functions":null},"database_specific":{"informational":"unsound","categories":["memory-exposure"],"cvss":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0401.json"}}],"schema_version":"1.9.0"}