Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#buffer-overflow #experimental #zstdmt

References

• https://github.com/gyscos/zstd-rs/commit/682b8b2967cf4aba5cfe2d940d1e381a3e23211a
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <4.1.4

Affected Functions

Version

zstd_safe::CCtx::try_clone

• >=4.1.4, <8.2.0

Description

CCtx::try_clone (experimental feature, deprecated) copies tables sized from the context's applied parameters. Starting a multithreaded frame (zstdmt feature) replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wrote up to 512 KiB past a heap allocation, or read past one. This became reachable with the bundled zstd 1.5.6.

The flaw was corrected by refusing try_clone (and the unsafe compress_block) once NbWorkers was set on the context.

Advisory available under CC0-1.0 license.