ZSTD seekable decompress shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and Seekable::decompress passed that length to Vec::set len.

With the seekable feature, whoever supplies the archive, or chooses the offset, can leave the caller's Vec<u8> with a length far beyond its capacity. Reading it then discloses neighbouring heap memory, and appending to it corrupts memory. Offsets near u64::MAX can also hang the call.

The flaw was corrected by clamping requests to the end of the data, and by checking every count reported by the C library against the buffer capacity.