Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-exposure

Keywords

#seekable #out-of-bounds

References

• https://github.com/gyscos/zstd-rs/commit/20d397c0d68d8b4300c5493875ebfa10e355fcdd
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <7.2.2

Affected Functions

Version

zstd_safe::seekable::SeekableCStream::compress_stream

• >=7.2.2, <8.2.0

Description

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTD_seekable_compressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and compressed that memory into the output.

The flaw was corrected by checking the position before every call into the C library.

Advisory available under CC0-1.0 license.