{"id":"GHSA-mc9m-6fm9-pghc","title":"Zoo Design Studio: Memory-corruption in memory handling of lib-kcl","summary":"Zoo Design Studio: Memory-corruption in memory handling of lib-kcl","severity":"medium","cwe":["CWE-362","CWE-416"],"vendor":"zoo-kcl","product":"zoo-kcl","ecosystem":"pip","affected":["zoo-kcl < 0.3.153","kcl-lib < 0.2.153"],"patched":["zoo-kcl 0.3.153","kcl-lib 0.2.153"],"published":"2026-08-20","updated":"2026-08-20","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mc9m-6fm9-pghc","references":[{"url":"https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-mc9m-6fm9-pghc"},{"url":"https://github.com/advisories/GHSA-mc9m-6fm9-pghc"}],"tags":["ghsa","pip"],"ingestedAt":"2026-08-20T18:59:55.331Z","slug":"GHSA-mc9m-6fm9-pghc","body":"## Overview\n\nA race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.\n\n## Affected packages\n\n- `zoo-kcl < 0.3.153`\n- `kcl-lib < 0.2.153`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zoo-kcl 0.3.153`\n- `kcl-lib 0.2.153`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}