GHSA-mc9m-6fm9-pghcMediumDisclosed before NVD

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

Published
August 20, 2026
Last Modified
August 20, 2026

📋 Description

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box>.

🎯 Affected products2

  • pip/zoo-kcl:< 0.3.153
  • rust/kcl-lib:< 0.2.153

🔗 References (2)