Skip to content
Heist/ feed
Back to feed
UnratedFix available

Out-of-bounds read when training a dictionary from inconsistent sample sizes

Type: advisorySources: OSV

`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end. This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.

Products
zstd
Affected versions
Not specified
Fixed versions
0.4.10
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 14:47 UTC · Revision 1

Source evidence

Out-of-bounds read when training a dictionary from inconsistent sample sizes

core-osv · Original source

Published 16 Oct 2026, 12:00 UTC

`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end. This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.

osv:RUSTSEC-2026-0393

zstd

Fixed versions: 0.4.10

Complete source record
{
  "id": "d54214cd18d0de7e181cad79757dd3a83495b4fce208bd611539304df1d0ba7b",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0393",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Out-of-bounds read when training a dictionary from inconsistent sample sizes",
    "summary": "`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end. This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.",
    "evidence": "osv:RUSTSEC-2026-0393",
    "products": [
      {
        "name": {
          "value": "zstd",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.4.10",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "RUSTSEC-2026-0393",
      "aliases": [
        "RUSTSEC-2026-0393"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.1.1"
                },
                {
                  "fixed": "0.4.10"
                }
              ]
            }
          ],
          "package": {
            "name": "zstd",
            "purl": "pkg:cargo/zstd",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": null,
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0393.json",
            "categories": [
              "memory-exposure"
            ],
            "informational": "unsound"
          },
          "ecosystem_specific": {
            "affects": {
              "os": [],
              "arch": [],
              "functions": []
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-26T14:00:04.245510808Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/zstd",
        "https://rustsec.org/advisories/RUSTSEC-2026-0393.html",
        "https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f",
        "https://github.com/gyscos/zstd-rs/pull/384"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 454187,
  "published_at": "2026-10-16T12:00:00+00:00"
}