Use-after-free when changing a multithreaded context with an unfinished frame

When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the meantime, so: - unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`, `disable_dictionary`, `init*`, or `reset` with parameters) freed the dictionary a worker was still compressing against; - changing `NbWorkers` made the next frame resize the job table before waiting for the old jobs. The flaw was corrected by refusing these calls while a multithreaded frame is unfinished. The new `CCtx::wait_for_workers()` waits for the workers first.

Source published

16 Oct 2026 12:00:00 UTC

Source modified

26 Oct 2026 14:00:05 UTC

Observed here

26 Oct 2026 14:35:44 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.