Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

`CCtx::try_clone` (`experimental` feature, deprecated) copies tables sized from the context's applied parameters. Starting a multithreaded frame (`zstdmt` feature) replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wrote up to 512 KiB past a heap allocation, or read past one. This became reachable with the bundled zstd 1.5.6. The flaw was corrected by refusing `try_clone` (and the unsafe `compress_block`) once `NbWorkers` was set on the context.

Source published

16 Oct 2026 12:00:00 UTC

Source modified

26 Oct 2026 14:00:05 UTC

Observed here

26 Oct 2026 14:35:44 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.