anthropics buffa up to 0.6.x OwnedView decode use after free

Summaryinfo

A vulnerability described as critical has been identified in anthropics buffa up to 0.6.x. This vulnerability affects the function decode of the component OwnedView. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-55406. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in anthropics buffa up to 0.6.x and classified as critical. Affected by this issue is the function decode of the component OwnedView. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-55406 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.7.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• anthropics

Name

• buffa

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6

Website

• Product: https://github.com/anthropics/buffa/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion