THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-9pwq-gcrx-wghh (medium) — Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

[GHSA] GHSA-9pwq-gcrx-wghh (medium) — Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

highgithub_advisoriesPublished 2026-08-28

GHSA-9pwq-gcrx-wghh Severity: medium CVE: CVE-2026-55406

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in `buffa`'s `OwnedView<V>` allowed safe Rust code to trigger a use-after-free. The `OwnedView::decode` constructor transmuted a borrowed slice to `&'static [u8]`, and the `Deref` implementation exposed the promoted `'static` lifetime on

Indicators of compromise

CVE-2026-55406cve
hackerone.comdomain

Original source: https://github.com/advisories/GHSA-9pwq-gcrx-wghh