{"id":"CVE-2026-55406","aliases":["GHSA-9pwq-gcrx-wghh"],"title":"Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","summary":"Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref","severity":"medium","cwe":["CWE-200","CWE-416"],"vendor":"buffa","product":"buffa","ecosystem":"rust","affected":["buffa < 0.7.0"],"patched":["buffa 0.7.0"],"published":"2026-08-28","updated":"2026-08-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9pwq-gcrx-wghh","references":[{"url":"https://github.com/anthropics/buffa/security/advisories/GHSA-9pwq-gcrx-wghh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55406"},{"url":"https://github.com/anthropics/buffa/pull/154"},{"url":"https://github.com/anthropics/buffa/commit/7dcf50a1a40eca6ed8d6c6dd59f4310aa0d68b0e"},{"url":"https://github.com/anthropics/buffa/releases/tag/v0.7.0"},{"url":"https://github.com/advisories/GHSA-9pwq-gcrx-wghh"}],"tags":["ghsa","rust"],"epss":0.00193,"epssPercentile":0.09312,"ingestedAt":"2026-08-28T19:24:19.382Z","slug":"CVE-2026-55406","body":"## Overview\n\nA soundness bug in `buffa`'s `OwnedView<V>` allowed safe Rust code to trigger a use-after-free. The `OwnedView::decode` constructor transmuted a borrowed slice to `&'static [u8]`, and the `Deref` implementation exposed the promoted `'static` lifetime on borrowed view fields (such as `&'static str` and `&'static [u8]`) to callers. Because these references appeared to be `'static`, the borrow checker permitted them to outlive the `OwnedView`; once the `OwnedView` was dropped and its backing buffer freed, those references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse — all without any `unsafe` code in the calling application. Users are advised to update to the latest patched version of buffa.\n\nThank you to hackerone.com/suul for reporting this issue.\n\n## Affected packages\n\n- `buffa < 0.7.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `buffa 0.7.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}