Out-of-bounds read with an out-of-range `InBuffer::pos`

{
  "id": "0632d5d72f821fd1b343599beaef6d8c00cf0d790613ccb9be41c4a300c8b3f3",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0405",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Out-of-bounds read with an out-of-range `InBuffer::pos`",
    "summary": "`InBuffer`'s fields are public, so safe code can set `pos` past the end of `src`. The position was passed to the C library unchecked, and `ZSTD_seekable_compressStream`, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and compressed that memory into the output. The flaw was corrected by checking the position before every call into the C library.",
    "evidence": "osv:RUSTSEC-2026-0405",
    "products": [
      {
        "name": {
          "value": "zstd-safe",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "8.2.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "RUSTSEC-2026-0405",
      "aliases": [
        "RUSTSEC-2026-0405"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.2.2"
                },
                {
                  "fixed": "8.2.0"
                }
              ]
            }
          ],
          "package": {
            "name": "zstd-safe",
            "purl": "pkg:cargo/zstd-safe",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": null,
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0405.json",
            "categories": [
              "memory-exposure"
            ],
            "informational": "unsound"
          },
          "ecosystem_specific": {
            "affects": {
              "os": [],
              "arch": [],
              "functions": [
                "zstd_safe::seekable::SeekableCStream::compress_stream"
              ]
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-26T14:00:05.680942523Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/zstd-safe",
        "https://rustsec.org/advisories/RUSTSEC-2026-0405.html",
        "https://github.com/gyscos/zstd-rs/commit/20d397c0d68d8b4300c5493875ebfa10e355fcdd",
        "https://github.com/gyscos/zstd-rs/pull/384"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 454194,
  "published_at": "2026-10-16T12:00:00+00:00"
}