AIKIDO-2026-36364

zstd-ruby is vulnerable to Out-of-bounds Read

Out-of-bounds Read Pre-CVE Published Aug 10, 2026

Medium Risk

This Affects:

zstd-ruby

1.5.4.1 - 2.0.6

Fixed in 2.0.7

Are you affected? Scan for Free

TL;DR

The skippable-frame helpers in the native extension mishandle memory. write_skippable_frame builds the output Ruby string from the input pointer using a length that also includes the header and payload sizes, so it reads past the end of the input buffer and copies adjacent heap memory into the produced frame. read_skippable_frame dereferences its argument as string internals without validating the type, so a non-String value is reinterpreted and crashes the process. The fix allocates the output buffer without the over-read and validates the argument type before access.

Who does this affect?

You are affected if you use a version in the vulnerable range and your application calls the skippable-frame helpers. Zstd.write_skippable_frame over-reads memory adjacent to the input buffer on every call and can copy those bytes into the frame it returns (which your application may then store or transmit); Zstd.read_skippable_frame crashes the process when it receives a non-String value, so forwarding an externally-influenced or unvalidated argument to it can cause a denial of service.