2 matches found
Use-after-free with `CParameter::StableInBuffer`
With CParameter::StableInBuffertrue experimental feature, the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flushstream and endstream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in...
6AI score
SaveExploits0Affected Software1
PT-2026-125054
With CParameter::StableInBuffertrue experimental feature, the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flush stream and end stream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in...
6AI score
SaveExploits0References5
20