Zstd: Out-of-bounds read when training a dictionary from inconsistent sample sizes
Affects zstdSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.4.10
Data as of 26 Oct 2026, 16:13 UTC
What to do
Upgrade zstd to 0.4.10.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iozstdpkg:cargo/zstdOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end. This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.