RUSTSEC-2026-0410 WebAssembly allocator shim corrupts memory on allocation failure
- Exploited in the wild
- Not known
- Fix
- Available
What is RUSTSEC-2026-0410?
RUSTSEC-2026-0410 is a vulnerability in zstd-sys, published on 16 Oct 2026.
Official description
On wasm32, zstd-sys provides malloc and free to the C library through a
shim over Rust's allocator. The shim did not check for allocation failure:
it wrote its size header to address 0 and returned address 4, which the C
library used as a valid buffer. free(NULL) also read below address 0.
Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox.
The flaw was corrected by returning NULL on allocation failure or size
overflow, and by making free(NULL) a no-op.
Which versions are affected by RUSTSEC-2026-0410?
1 open source package ship an affected version, including zstd-sys.
| Package | Affected | Fixed in |
|---|---|---|
zstd-sys crates.io | From 2.0.9 | 2.1.2 |
How do I fix RUSTSEC-2026-0410?
Upgrade zstd-sys to 2.1.2 or later.
Is RUSTSEC-2026-0410 being exploited?
There is no known exploitation of RUSTSEC-2026-0410 in the wild and no public exploit code.