rustsec-2026-0410

debian_rustsec
Description

On wasm32, zstd-sys provides `malloc` and `free` to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. `free(NULL)` also read below address 0. Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox. The flaw was corrected by returning NULL on allocation failure or size overflow, and by making `free(NULL)` a no-op.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [],
  "categories": [
    "memory-corruption"
  ],
  "crate": "zstd-sys",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-16",
  "deb_packages": [
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "doxx",
      "deb_name": "doxx",
      "version": "0.1.4+ds-1"
    },
    {
      "crate_name": "git-cinnabar",
      "deb_name": "git-cinnabar",
      "version": "0.7.3-2+b2"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": null,
      "deb_name": "rustup",
      "version": "1.27.1-8+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    }
  ],
  "description": "On wasm32, zstd-sys provides `malloc` and `free` to the C library through a\nshim over Rust's allocator. The shim did not check for allocation failure:\nit wrote its size header to address 0 and returned address 4, which the C\nlibrary used as a valid buffer. `free(NULL)` also read below address 0.\n\nWhenever the instance cannot grow its memory by what a frame asks for, a\nsmall crafted frame (a 9-byte header declaring a 128 MiB window is enough)\nmade decompression write decoded data over the bottom of the module's\nlinear memory, instead of failing. The corruption stays within the wasm\nsandbox.\n\nThe flaw was corrected by returning NULL on allocation failure or size\noverflow, and by making `free(NULL)` a no-op.",
  "id": "RUSTSEC-2026-0410",
  "keywords": [
    "wasm",
    "allocation"
  ],
  "patched_versions": [
    ">=2.1.2"
  ],
  "source": "debian_rustsec",
  "title": "WebAssembly allocator shim corrupts memory on allocation failure",
  "url": "https://github.com/gyscos/zstd-rs/commit/165d1625553c236b9700ca794b8a7c51f5d98314"
}
View JSON API Download JSON