Executive brief
Buffa is a Rust library for encoding and decoding protocol buffer messages. A soundness bug in its OwnedView component allowed attackers to access memory references that outlived the underlying buffer, leading to use-after-free conditions. This could enable reading sensitive data from freed memory, causing data leaks or application crashes. The vulnerability affects applications using buffa versions prior to 0.7.0 and requires updating to the patched version.
Technical details
The vulnerability is a use-after-free (CWE-416) caused by unsound lifetime promotion in the OwnedView<V> type. The OwnedView::decode constructor unsafely transmuted a borrowed slice &[u8] to &'static [u8]. The Deref trait implementation then exposed this synthetic 'static lifetime to callers through borrowed view fields (e.g., &'static str, &'static [u8]). Since the borrow checker saw these references as having 'static lifetime, it allowed them to outlive the OwnedView container. When OwnedView was dropped and its backing Bytes buffer freed, these references became dangling pointers, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse. Exploitation requires only safe Rust code; no unsafe code is necessary in the calling application. The fix (version 0.7.0) removes the Deref implementation and replaces it with generated FooOwnedView accessor wrappers that tie all borrows to the OwnedView's lifetime.
Affected products
- Anthropics buffa < 0.7.0
Timeline
- 2026-07-01: disclosed: Published to GitHub Advisory Database
- 2026-05-28: patched: Patch merged (commit 7dcf50a)
- 2026-08-28: advisory: Advisory updated
References
- https://github.com/anthropics/buffa/security/advisories/GHSA-9pwq-gcrx-wghh
- https://github.com/anthropics/buffa/pull/154
- https://github.com/anthropics/buffa/commit/7dcf50a1a40eca6ed8d6c6dd59f4310aa0d68b0e
- https://github.com/anthropics/buffa/releases/tag/v0.7.0
- https://api.github.com/repos/anthropics/buffa/security-advisories/GHSA-9pwq-gcrx-wghh