Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

Vulnerability

Categories

• memory-exposure
• memory-corruption

Keywords

#seekable #out-of-bounds

References

• https://github.com/gyscos/zstd-rs/commit/80506be743fae2ed0c2fe8b21c374c6a2eab0be7
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <7.2.2

Affected Functions

Version

zstd_safe::seekable::AdvancedSeekable::decompress

• >=7.2.2, <8.2.0

zstd_safe::seekable::Seekable::decompress

• >=7.2.2, <8.2.0

Description

ZSTD_seekable_decompress shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and Seekable::decompress passed that length to Vec::set_len.

With the seekable feature, whoever supplies the archive, or chooses the offset, can leave the caller's Vec<u8> with a length far beyond its capacity. Reading it then discloses neighbouring heap memory, and appending to it corrupts memory. Offsets near u64::MAX can also hang the call.

The flaw was corrected by clamping requests to the end of the data, and by checking every count reported by the C library against the buffer capacity.

Advisory available under CC0-1.0 license.