PT-2026-60502 · Pypi · Buffa
CVE-2026-55406
·
Published
2026-07-16
·
Updated
2026-08-28
CVSS v4.0
5.9
Medium
| Vector | AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Buffa versions prior to 0.7.0
Description
A soundness bug in the
OwnedView<V> type allows safe Rust code to trigger a use-after-free. The OwnedView::decode() constructor transmutes a borrowed slice to &'static [u8], and the Deref implementation exposes this promoted 'static lifetime on borrowed view fields, such as &'static str and &'static [u8], to callers. Consequently, the borrow checker allows these references to outlive the OwnedView. When the OwnedView is dropped and its backing buffer is freed, the references become dangling, which can lead to memory corruption, information disclosure of freed heap contents, and cross-thread misuse.Recommendations
Update to version 0.7.0.
Exploit
Fix
Use After Free
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Buffa