{"id":"CVE-2026-55406","sourceIdentifier":"security-advisories@github.com","published":"2026-07-16T17:16:57.623","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0."},{"lang":"es","value":"Buffa es una implementación puramente en Rust de Protocol Buffers con soporte de primera clase para ediciones de protobuf. Antes de la versión 0.7.0, un error de solidez en el tipo OwnedView[V] permitía que código Rust seguro desencadenara un uso después de liberación: el constructor OwnedView::decode transmutaba un ’slice’ prestado a &’static [u8], y la implementación de Deref exponía la vida útil ’static promovida en campos de vista prestados (como &’static str y &’static [u8]) a los llamadores, por lo que el verificador de préstamos permitía que esas referencias sobrevivieran al OwnedView; una vez que el OwnedView era descartado y su búfer de respaldo liberado, las referencias quedaban colgantes, lo que permitía la corrupción de memoria, la revelación de información del contenido de la memoria ’heap’ liberada y el uso indebido entre hilos sin ningún código inseguro en la aplicación llamadora. Este problema está solucionado en la versión 0.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"anthropics","product":"buffa","versions":[{"version":"< 0.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-16T16:47:16.390744Z","id":"CVE-2026-55406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/anthropics/buffa/commit/7dcf50a1a40eca6ed8d6c6dd59f4310aa0d68b0e","source":"security-advisories@github.com"},{"url":"https://github.com/anthropics/buffa/pull/154","source":"security-advisories@github.com"},{"url":"https://github.com/anthropics/buffa/releases/tag/v0.7.0","source":"security-advisories@github.com"},{"url":"https://github.com/anthropics/buffa/security/advisories/GHSA-9pwq-gcrx-wghh","source":"security-advisories@github.com"}]}