Buffa CVE-2026-55406

Exploitation requires calling application code that captures a view field reference (e.g., &str, &[u8]) from an OwnedView handle and holds that reference in a data structure or variable that outlives the OwnedView itself. The compiler does not reject this pattern prior to 0.7.0 because the Deref impl presented the field lifetimes as 'static. No network access, authentication, or attacker-controlled input is required for the memory-safety violation to occur - however, for information disclosure to be meaningful to an attacker, the freed heap region must be subsequently reallocated with sensitive data and the dangling reference must be read and surfaced (e.g., logged, returned in a response). Exploitation is limited to: (1) Rust applications directly using the buffa crate's OwnedView type, (2) code paths that store field references beyond the OwnedView's lifetime, and (3) Buffa versions before 0.7.0. Applications using only short-lived, stack-scoped borrows from OwnedView are not exposed even on vulnerable versions.

The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) scores 5.9 (Medium), and the vendor's own CHANGELOG explicitly qualifies the exposure: 'in practice this required the calling application to deliberately store a field reference beyond the handle's lifetime, so the practical exposure is limited.' This is not a remotely triggerable flaw against a networked service endpoint; exploitation requires specific application-level code that retains OwnedView field references across the handle's drop point. The local attack vector and high-complexity/specific-attack-requirement ratings are consistent with this description. There is no CISA KEV listing and no public POC or exploit code identified at time of analysis, so EPSS risk is expected to be low. Real-world impact is bounded by whether downstream applications actually exhibit the misuse pattern; library consumers using idiomatic short-lived borrows are not exposed. The primary risk category is confidentiality (VC:H - freed heap contents may contain sensitive protobuf field data from prior requests), with limited integrity impact (VI:L - memory corruption is theoretically possible). No EPSS value was provided in the input data - exploitation probability cannot be quantified from available signals.

An application decodes a protobuf message into an OwnedView<PersonView> and stores a field reference such as let name: &str = &*owned_view.name into a longer-lived struct or async task. When the OwnedView is subsequently dropped at end of scope, the underlying Bytes buffer is freed. The stored name reference now points into freed heap memory; a subsequent read of name yields freed heap contents, potentially disclosing data from a prior allocation such as a previous request's protobuf field values. No POC has been identified; the scenario requires the specific misuse pattern acknowledged by the vendor.