RUSTSEC-2026-0406

Use-after-free when changing a multithreaded context with an unfinished frame

Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

memory-corruption

Keywords

#use-after-free #zstdmt #dictionary

References

Patched

>=8.2.0

Affected Functions

Version

zstd_safe::CCtx::disable_dictionary

<8.2.0

zstd_safe::CCtx::init

<8.2.0

zstd_safe::CCtx::load_dictionary

<8.2.0

zstd_safe::CCtx::ref_cdict

<8.2.0

zstd_safe::CCtx::ref_prefix

<8.2.0

zstd_safe::CCtx::reset

<8.2.0

zstd_safe::CCtx::set_parameter

<8.2.0

Description

When a multithreaded frame (zstdmt feature, CParameter::NbWorkers) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the meantime, so:

unloading the dictionary (load_dictionary, ref_cdict, ref_prefix, disable_dictionary, init*, or reset with parameters) freed the dictionary a worker was still compressing against;
changing NbWorkers made the next frame resize the job table before waiting for the old jobs.

The flaw was corrected by refusing these calls while a multithreaded frame is unfinished. The new CCtx::wait_for_workers() waits for the workers first.

Advisory available under CC0-1.0 license.