RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
- Exploited in the wild
- Not known
- Fix
- Available
What is RUSTSEC-2026-0402?
RUSTSEC-2026-0402 is a vulnerability in zstd-safe, published on 16 Oct 2026.
Official description
CCtx::try_clone (experimental feature, deprecated) copies tables sized
from the context's applied parameters. Starting a multithreaded frame
(zstdmt feature) replaces those parameters with the workers' without
resizing the context's own tables, so after an abandoned single-threaded
frame, the copy wrote up to 512 KiB past a heap allocation, or read past
one. This became reachable with the bundled zstd 1.5.6.
The flaw was corrected by refusing try_clone (and the unsafe
compress_block) once NbWorkers was set on the context.
Which versions are affected by RUSTSEC-2026-0402?
1 open source package ship an affected version, including zstd-safe.
| Package | Affected | Fixed in |
|---|---|---|
zstd-safe crates.io | From 4.1.4 | 8.2.0 |
How do I fix RUSTSEC-2026-0402?
Upgrade zstd-safe to 8.2.0 or later.
Is RUSTSEC-2026-0402 being exploited?
There is no known exploitation of RUSTSEC-2026-0402 in the wild and no public exploit code.