Zstd safe: `OutBuffer::around_pos` exposes uninitialized memory
Affects zstd-safeSource GCVE Database
0
Severity
UnratedRated by Threat Radar
- Patch
- Available – fixed in 8.2.0
Data as of 26 Oct 2026, 16:13 UTC
What to do
Upgrade zstd-safe to 8.2.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iozstd-safepkg:cargo/zstd-safeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
`OutBuffer::around_pos` accepted a position past the initialized length of a `Vec<u8>`. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position. The flaw was corrected by zero-filling that gap.
References
Community reviews
Loading reviews…