{"id":"RUSTSEC-2026-0396","revision":"b3ba37f76aa24a2ba71312ac1d43593d","records":[{"revision":"b3ba37f76aa24a2ba71312ac1d43593d","observedAt":"2026-10-26T14:35:44.727+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0396","aliases":[],"title":"`Seekable` reads a NULL or out-of-bounds seek table","description":"`Seekable` did not record whether it was initialized. On a fresh `Seekable`,\nor one whose `init_buff()` failed, `decompress`, `offset_to_frame_index` and\n`frame_decompressed_size` made the C library read a NULL seek table. After a\nfailed re-initialization, `decompress` returned data from the refused buffer\nusing the previous seek table.\n\nSeparately, `frame_decompressed_size(num_frames())`, on `Seekable` and\n`SeekTable`, read one entry past the end of the seek table.\n\nThe flaw was corrected by refusing to use a `Seekable` until an\ninitialization succeeded, and by checking the frame index.","state":0,"publishedAt":"2026-10-16T12:00:00+00:00","modifiedAt":"2026-10-26T14:00:05.7896821+00:00","affected":[{"ecosystem":"crates.io","name":"zstd-safe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.2.2"},{"kind":"fixed","version":"8.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/zstd-safe","https://rustsec.org/advisories/RUSTSEC-2026-0396.html","https://github.com/gyscos/zstd-rs/commit/a9626069d6f2e90b782b8f627f57a361cfe8ef85","https://github.com/gyscos/zstd-rs/pull/384"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0396","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0396","identifiers":["RUSTSEC-2026-0396"]},"retained":false,"historicalAffected":[]}],"coverage":[]}