rustsec-2026-0398

debian_rustsec
Description

`ZSTD_seekable_decompress` shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and `Seekable::decompress` passed that length to `Vec::set_len`. With the `seekable` feature, whoever supplies the archive, or chooses the offset, can leave the caller's `Vec<u8>` with a length far beyond its capacity. Reading it then discloses neighbouring heap memory, and appending to it corrupts memory. Offsets near `u64::MAX` can also hang the call. The flaw was corrected by clamping requests to the end of the data, and by checking every count reported by the C library against the buffer capacity.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [],
  "categories": [
    "memory-exposure",
    "memory-corruption"
  ],
  "crate": "zstd-safe",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-16",
  "deb_packages": [
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "doxx",
      "deb_name": "doxx",
      "version": "0.1.4+ds-1"
    },
    {
      "crate_name": "git-cinnabar",
      "deb_name": "git-cinnabar",
      "version": "0.7.3-2+b2"
    },
    {
      "crate_name": "zstd-safe",
      "deb_name": "librust-zstd-safe-dev",
      "version": "7.2.4-1+b1"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "rustup",
      "version": "1.27.1-8+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "ty",
      "version": "0.0.85+ruff0.16.10+ds-2"
    }
  ],
  "description": "`ZSTD_seekable_decompress` shortens the requested length to the end of the\ndata without checking that the offset is before it. For an offset past the\nend, it returns a wrapped-around length without writing anything, and\n`Seekable::decompress` passed that length to `Vec::set_len`.\n\nWith the `seekable` feature, whoever supplies the archive, or chooses the\noffset, can leave the caller's `Vec<u8>` with a length far beyond its\ncapacity. Reading it then discloses neighbouring heap memory, and appending\nto it corrupts memory. Offsets near `u64::MAX` can also hang the call.\n\nThe flaw was corrected by clamping requests to the end of the data, and by\nchecking every count reported by the C library against the buffer capacity.",
  "id": "RUSTSEC-2026-0398",
  "keywords": [
    "seekable",
    "out-of-bounds"
  ],
  "patched_versions": [
    "^7.4.0",
    ">=8.2.0"
  ],
  "source": "debian_rustsec",
  "title": "`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end",
  "url": "https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7"
}
View JSON API Download JSON