CVE-2026-55406
MediumCVSS 5.9Summary
A soundness bug in the OwnedView<V> type of the Buffa library (a pure-Rust Protocol Buffers implementation) allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor incorrectly transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on view fields, enabling access to freed memory.
Risk Assessment
An attacker could exploit this vulnerability to read freed heap contents (information disclosure) or corrupt memory, potentially leading to unauthorized data exposure or system crashes. The vulnerability is particularly dangerous because it can be triggered without any unsafe code in the calling application.
Recommendation
Immediately upgrade the Buffa library to version 0.7.0 or later, which contains the fix for this security bug.
Other vulnerabilities in Buffa
Original NVD description (English source)
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS