RUSTSEC-2026-0396 `Seekable` reads a NULL or out-of-bounds seek table
- Exploited in the wild
- Not known
- Fix
- Available
What is RUSTSEC-2026-0396?
RUSTSEC-2026-0396 is a vulnerability in zstd-safe, published on 16 Oct 2026.
Official description
Seekable did not record whether it was initialized. On a fresh Seekable,
or one whose init_buff() failed, decompress, offset_to_frame_index and
frame_decompressed_size made the C library read a NULL seek table. After a
failed re-initialization, decompress returned data from the refused buffer
using the previous seek table.
Separately, frame_decompressed_size(num_frames()), on Seekable and
SeekTable, read one entry past the end of the seek table.
The flaw was corrected by refusing to use a Seekable until an
initialization succeeded, and by checking the frame index.
Which versions are affected by RUSTSEC-2026-0396?
1 open source package ship an affected version, including zstd-safe.
| Package | Affected | Fixed in |
|---|---|---|
zstd-safe crates.io | From 7.2.2 | 8.2.0 |
How do I fix RUSTSEC-2026-0396?
Upgrade zstd-safe to 8.2.0 or later.
Is RUSTSEC-2026-0396 being exploited?
There is no known exploitation of RUSTSEC-2026-0396 in the wild and no public exploit code.