# zstd-safe use-after-free in dictionary decompression context

Source: https://junglewise.ai/threats/rustsec-2026-0400-use-after-free-of-a-dictionary-after-a-one-shot-call-541157eb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-10-16

zstd-safe is a Rust library that provides compression and decompression functionality. A use-after-free vulnerability exists when an application mixes streaming and one-shot decompression calls on the same context without proper resets, allowing an attacker to read freed heap memory or corrupt output. Exploitation requires specific application code patterns and does not occur in typical single-mode usage.

Technologies: [zstd-safe (crates.io)](https://junglewise.ai/threats/technologies/zstd-safe), [Zstd-Rs Zstd-Safe](https://junglewise.ai/threats/technologies/zstd-rs-zstd-safe). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Zstd-Rs](https://junglewise.ai/threats/vendors/zstd-rs).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** zstd-safe (crates.io) SEMVER:introduced=3.0.1,fixed=8.2.0; Zstd-Rs Zstd-Safe 3.0.1 to 8.1.x.

**Is there a fix for This vulnerability?** Yes. zstd-safe (crates.io): upgrade to 8.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access.

**Am I affected?** Check whether you run zstd-safe (crates.io) or Zstd-Rs Zstd-Safe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zstd-safe (crates.io): upgrade to 8.2.0 or later

  ```sh
  cargo update -p zstd-safe
  ```


## Technical details

The vulnerability is a use-after-free in the DCtx decompression context when one-shot methods (decompress, decompress_using_dict, decompress_using_ddict) are called on a context with an open unfinished stream. The underlying C library does not reset the context state, leaving the stream active. A subsequent streaming call resumes against freed dictionary memory, exposing heap contents in decompressed output. This requires an application to interleave streaming and one-shot operations without explicit context resets.

## Affected products

- zstd-rs zstd-safe 3.0.1 to 8.1.x

## Timeline

- 2026-10-16: disclosed
- 2026-10-26: patched

## References

- [https://crates.io/crates/zstd-safe](https://crates.io/crates/zstd-safe)
- [https://rustsec.org/advisories/RUSTSEC-2026-0400.html](https://rustsec.org/advisories/RUSTSEC-2026-0400.html)

## Related threats

- [zstd-safe use-after-free in multithreaded compression context](https://junglewise.ai/threats/rustsec-2026-0406-use-after-free-when-changing-a-multithreaded-context-0c474512)
- [zstd-safe double free in DCtx::try_clone](https://junglewise.ai/threats/rustsec-2026-0404-double-free-in-dctx-try-clone-108878f4)
- [zstd-safe Seekable decompress buffer overrun on invalid offset](https://junglewise.ai/threats/rustsec-2026-0398-seekable-decompress-sets-a-vec-length-beyond-its-2f278ece)
- [zstd-safe Seekable null or out-of-bounds seek table read](https://junglewise.ai/threats/rustsec-2026-0396-seekable-reads-a-null-or-out-of-bounds-seek-table-4b9e21ae)
- [zstd-safe out-of-bounds read in seekable stream compression](https://junglewise.ai/threats/rustsec-2026-0405-out-of-bounds-read-with-an-out-of-range-inbuffer-pos-610ef200)