Read the docs
TI-2026-39976 Aliases CVE-2026-55406GHSA-9pwq-gcrx-wghh

Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

Priority LOW 26CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed buffa (anthropics): 0.7.0buffa (crates.io): 0.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anthropicsbuffabefore 0.7.00.7.0Patch availableCNA
—buffa (crates.io)before 0.7.00.7.0Patch availableGHSA-9pwq-gcrx-wghh
  • buffa Vendoranthropics Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA
  • buffa (crates.io) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-9pwq-gcrx-wghh

Remediation

  • Fix · CNA buffa (anthropics) Fixed in 0.7.0
  • Fix · GHSA-9pwq-gcrx-wghh buffa (crates.io) Fixed in 0.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55406
  2. 2026-10-03 Alias added: GHSA-9pwq-gcrx-wghh

References

Advisory 1

Other 5

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-00421 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS CVSS 4.0HIGH 8.7
  • TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
  • TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
  • TI-2025-24240 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling CVSS 4.0CRITICAL 9.3
  • TI-2025-32918 Claude Code IDE extensions allow websocket connections from arbitrary origins CVSS 4.0HIGH 8.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences