CVE-2026-55406: Anthropics Buffa use-after-free in OwnedView

CVE-2026-55406 · Severity: medium · CVSS 4 · Published 2026-07-16

Buffa is a Rust library for encoding and decoding protocol buffer messages. A soundness bug in its OwnedView component allowed attackers to access memory references that outlived the underlying buffer, leading to use-after-free conditions. This could enable reading sensitive data from freed memory, causing data leaks or application crashes. The vulnerability affects applications using buffa versions prior to 0.7.0 and requires updating to the patched version.

Vendors: Anthropic, crates.io.

Quick answers

Is CVE-2026-55406 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55406 being exploited in the wild.
How severe is CVE-2026-55406?
Medium severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Anthropic Buffa < 0.7.0; buffa (crates.io) SEMVER:introduced=0,fixed=0.7.0.
Is there a fix for CVE-2026-55406?
Yes. buffa (crates.io): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55406 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-55406?
Check whether you run Anthropic Buffa or buffa (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • buffa (crates.io): upgrade to 0.7.0 or later
    cargo update -p buffa

Technical details

The vulnerability is a use-after-free (CWE-416) caused by unsound lifetime promotion in the OwnedView<V> type. The OwnedView::decode constructor unsafely transmuted a borrowed slice &[u8] to &'static [u8]. The Deref trait implementation then exposed this synthetic 'static lifetime to callers through borrowed view fields (e.g., &'static str, &'static [u8]). Since the borrow checker saw these references as having 'static lifetime, it allowed them to outlive the OwnedView container. When OwnedView was dropped and its backing Bytes buffer freed, these references became dangling pointers, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse. Exploitation requires only safe Rust code; no unsafe code is necessary in the calling application. The fix (version 0.7.0) removes the Deref implementation and replaces it with generated FooOwnedView accessor wrappers that tie all borrows to the OwnedView's lifetime.

Affected products

  • Anthropics buffa < 0.7.0

Identifiers

  • CVE-2026-55406
  • GHSA-9pwq-gcrx-wghh

Timeline

  • 2026-07-01: disclosed: Published to GitHub Advisory Database
  • 2026-05-28: patched: Patch merged (commit 7dcf50a)
  • 2026-08-28: advisory: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.