Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-exposure

Keywords

#uninitialized-memory

References

• https://github.com/gyscos/zstd-rs/commit/5827de2459b8ac430e87e860f00c7f3c13023833
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <4.0.0

Affected Functions

Version

zstd_safe::OutBuffer::around_pos

• >=4.0.0, <8.2.0

Description

OutBuffer::around_pos accepted a position past the initialized length of a Vec<u8>. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position.

The flaw was corrected by zero-filling that gap.

Advisory available under CC0-1.0 license.