GHSA-mc9m-6fm9-pghc#kcl-lib

Summary

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

Severity

medium

CWE

CWE-362, CWE-416

Published

2026-08-20

Updated

2026-08-20

Advisory details

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box>.

References

• https://github.com/advisories/GHSA-mc9m-6fm9-pghc
• https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-mc9m-6fm9-pghc

Related advisories

• GHSA-mc9m-6fm9-pghc#zoo-kcl — medium · PyPI/zoo-kcl
• GHSA-jgvr-6x5w-hx5w#kcl-lib — medium · crates.io/kcl-lib
• CVE-2026-62815 — critical · NuGet/Microsoft.Native.Quic.MsQuic.OpenSSL
• CVE-2026-96889 — high · crates.io/librsvg
• CVE-2026-112402 — high · PyPI/Pillow
• CVE-2026-111770 — high · npm/@modelcontextprotocol/server
• CVE-2026-82416 — high · Go/github.com/dunglas/frankenphp
• CVE-2026-70183 — high · NuGet/Microsoft.AspNetCore.App.Runtime.linux-arm

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity