MEDIUM GitHub
CVE-2026-55406
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
A soundness bug in `buffa`'s `OwnedView<V>` allowed safe Rust code to trigger a use-after-free. The `OwnedView::decode` constructor transmuted a borrowed slice to `&'static [u8]`, and the `Deref` implementation exposed the promoted `'static` lifetime on borrowed view fields (such as `&'static str` and `&'static [u8]`) to callers. Because these references appeared to be `'static`, the borrow checker permitted them to outlive the `OwnedView`; once the `OwnedView` was dropped and its backing buffer
Affected Products
- rust/buffa < 0.7.0
References
- https://github.com/advisories/GHSA-9pwq-gcrx-wghh
- https://github.com/anthropics/buffa/security/advisories/GHSA-9pwq-gcrx-wghh
- https://nvd.nist.gov/vuln/detail/CVE-2026-55406
- https://github.com/anthropics/buffa/pull/154
This medium severity vulnerability was published on 2026-08-28 via GitHub. Affected: rust/buffa < 0.7.0.
vulnfeed aggregates 11493 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.