EUVD-2026-44949
GHSA-9pwq-gcrx-wghh
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because misuse requires specific application code pattern; AC:H for the non-default usage condition; C:H for freed-heap disclosure; I:L for theoretical memory corruption; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.
AnalysisAI
Use-after-free in Buffa's OwnedView<V> type allows safe Rust calling code to hold field references that outlive the backing buffer, enabling read of freed heap memory and information disclosure. Affected are all Buffa releases prior to 0.7.0 (CPE: cpe:2.3:a:anthropics:buffa:*:*:*:*:*:*:*:*). The flaw is a soundness violation - no unsafe code in the caller is required - making it particularly insidious in a memory-safe language context. No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 4.0 score of 5.9 reflects the high-complexity exploitation conditions acknowledged by the vendor.
Technical ContextAI
Buffa is a pure-Rust Protocol Buffers implementation (cpe:2.3:a:anthropics:buffa:*:*:*:*:*:*:*:*) with first-class protobuf editions support, developed by Anthropics. The OwnedView<V> type is a self-referential struct designed to allow decoded protobuf views to satisfy 'static bounds required by tower services, BoxFuture<'static, _>, and tokio::spawn. Internally, OwnedView stores a bytes::Bytes reference-counted buffer alongside the decoded view, using a transmute in OwnedView::decode to extend the view's lifetime to &'static [u8]. The Deref<Target = V> implementation then surfaced this synthetic 'static lifetime directly to callers: field types like &'static str and &'static [u8] were visible to the borrow checker as genuinely 'static, permitting any calling code to store those references in longer-lived data structures without compiler objection. When the OwnedView was subsequently dropped and its Bytes buffer freed, those stored references became dangling pointers into freed heap memory. The assigned CWE-200 (Exposure of Sensitive Information) captures the information-disclosure outcome, but the root cause is more precisely a use-after-free (CWE-416) arising from unsound lifetime extension via transmute - the 'Buffer Overflow' tag in the advisory metadata is misleading and does not match the described mechanism.
RemediationAI
Vendor-released patch: Buffa 0.7.0, available at https://github.com/anthropics/buffa/releases/tag/v0.7.0. Upgrading to 0.7.0 is the definitive fix. The patch removes the Deref<Target = V> implementation from OwnedView<V> entirely - a breaking change - so callers previously using direct field access via Deref (e.g., owned_view.name) must migrate to either the new reborrow() method (let person = owned.reborrow(); person.name) or the per-message generated FooOwnedView wrapper types with &self-tied accessor methods (owned_view.name()). Both alternatives tie every borrow lifetime to the OwnedView handle, making the misuse pattern the compiler rejects rather than silently permits. Fields whose proto names collide with reserved OwnedView wrapper method names remain accessible via view() with a build-time CodeGenWarning::OwnedViewAccessorSuppressed emitted. If immediate upgrade is not possible, the workaround is to audit all callsites using OwnedView and ensure no field references are stored in data structures that outlive the OwnedView handle - this is a code-review control with no automated enforcement prior to 0.7.0.
Same weakness CWE-200 – Information Exposure
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today