Executive brief
kcl-lib is a library used for parametric design workflows in Zoo Design Studio and related modeling applications. A race condition in how the library manages environment variables can cause applications to access freed memory when multiple operations happen concurrently, leading to application crashes or undefined behavior. This affects any application using kcl-lib for environment handling under concurrent access patterns.
Technical details
This vulnerability is a classic use-after-free caused by a race condition (CWE-362 and CWE-416) in the kcl-lib Rust library's environment management code. When a Vec containing Box pointers to Environment objects is reallocated, the old buffer is deallocated. A concurrent get_env operation may have already loaded a reference to the old buffer before reallocation; it then dereferences that stale pointer, accessing freed memory and retrieving corrupted or stale Pin<Box<Environment>> data. The vulnerability requires no authentication or user interaction and is exploitable over the network if the affected library processes untrusted concurrent requests. No confidentiality or integrity impact is documented, but availability can be compromised through denial of service. Patches are available in kcl-lib 0.2.153+ and zoo-kcl 0.3.153+.
Affected products
- KittyCAD kcl-lib < 0.2.153
- Zoo Design Studio zoo-kcl < 0.3.153
Timeline
- 2026-06-12: disclosed: Published to KittyCAD/modeling-app
- 2026-08-20: advisory: Published to GitHub Advisory Database
- 2026-06-12: patched: Patches available: kcl-lib 0.2.153+, zoo-kcl 0.3.153+