Skip to content
Heist/ feed
Back to feed
UnratedFix available

WebAssembly allocator shim corrupts memory on allocation failure

Type: advisorySources: OSV

On wasm32, zstd-sys provides `malloc` and `free` to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. `free(NULL)` also read below address 0. Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox. The flaw was corrected by returning NULL on allocation failure or size overflow, and by making `free(NULL)` a no-op.

Products
zstd-sys
Affected versions
Not specified
Fixed versions
2.1.2
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 14:47 UTC · Revision 1

Source evidence

WebAssembly allocator shim corrupts memory on allocation failure

core-osv · Original source

Published 16 Oct 2026, 12:00 UTC

On wasm32, zstd-sys provides `malloc` and `free` to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. `free(NULL)` also read below address 0. Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox. The flaw was corrected by returning NULL on allocation failure or size overflow, and by making `free(NULL)` a no-op.

osv:RUSTSEC-2026-0410

zstd-sys

Fixed versions: 2.1.2

Complete source record
{
  "id": "256096db5510df7da9bba2f571427f9303f65c7574cbce3c1ac12cad1168d786",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0410",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "WebAssembly allocator shim corrupts memory on allocation failure",
    "summary": "On wasm32, zstd-sys provides `malloc` and `free` to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. `free(NULL)` also read below address 0. Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox. The flaw was corrected by returning NULL on allocation failure or size overflow, and by making `free(NULL)` a no-op.",
    "evidence": "osv:RUSTSEC-2026-0410",
    "products": [
      {
        "name": {
          "value": "zstd-sys",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "RUSTSEC-2026-0410",
      "aliases": [
        "RUSTSEC-2026-0410"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "2.0.9"
                },
                {
                  "fixed": "2.1.2"
                }
              ]
            }
          ],
          "package": {
            "name": "zstd-sys",
            "purl": "pkg:cargo/zstd-sys",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": null,
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0410.json",
            "categories": [
              "memory-corruption"
            ],
            "informational": null
          },
          "ecosystem_specific": {
            "affects": {
              "os": [],
              "arch": [
                "wasm32"
              ],
              "functions": []
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-26T14:00:05.788985783Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/zstd-sys",
        "https://rustsec.org/advisories/RUSTSEC-2026-0410.html",
        "https://github.com/gyscos/zstd-rs/commit/165d1625553c236b9700ca794b8a7c51f5d98314",
        "https://github.com/gyscos/zstd-rs/pull/384"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 454203,
  "published_at": "2026-10-16T12:00:00+00:00"
}