Zstd safe: Use-after-free with `CParameter::StableInBuffer`

With `CParameter::StableInBuffer(true)` (`experimental` feature), the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including `flush_stream` and `end_stream`, which take no input. An `InBuffer` only borrows its slice for one call, so safe code could free it in between, and freed memory was compressed into the frame. The C library behaves this way since zstd 1.5.4, whether bundled or linked from the system. The flaw was corrected by refusing to enable the parameter.

• crates.io/crates/zstd-safe (opens in a new tab)
• rustsec.org/advisories/RUSTSEC-2026-0395.html (opens in a new tab)
• github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65 (opens in a new tab)
• github.com/gyscos/zstd-rs/pull/384 (opens in a new tab)

• Zstd safe: Use-after-free when changing a multithreaded context with an unfinished frameUnratedVulnerability2026-10-16
• Zstd safe: Out-of-bounds read with an out-of-range `InBuffer::pos`UnratedVulnerability2026-10-16
• Zstd safe: Double freeUnratedVulnerability2026-10-16
• Zstd safe: Uninitialized memory exposed when streaming decompression of a legacy frame failsUnratedVulnerability2026-10-16
• Zstd safe: Heap buffer overflowUnratedVulnerability2026-10-16