PT-2026-125064

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTD seekable compressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and...