RUSTSEC-2026-0395 Use-after-free with `CParameter::StableInBuffer`
- Exploited in the wild
- Not known
- Fix
- Available
What is RUSTSEC-2026-0395?
RUSTSEC-2026-0395 is a vulnerability in zstd-safe, published on 16 Oct 2026.
Official description
With CParameter::StableInBuffer(true) (experimental feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including flush_stream and end_stream, which take no
input. An InBuffer only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.
The flaw was corrected by refusing to enable the parameter.
Which versions are affected by RUSTSEC-2026-0395?
1 open source package ship an affected version, including zstd-safe.
| Package | Affected | Fixed in |
|---|---|---|
zstd-safe crates.io | From 4.1.0 | 8.2.0 |
How do I fix RUSTSEC-2026-0395?
Upgrade zstd-safe to 8.2.0 or later.
Is RUSTSEC-2026-0395 being exploited?
There is no known exploitation of RUSTSEC-2026-0395 in the wild and no public exploit code.