{"id":"GHSA-mc9m-6fm9-pghc","summary":"Zoo Design Studio: Memory-corruption in memory handling of lib-kcl","details":"A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin\u003cBox\u003cEnvironment\u003e\u003e.","modified":"2026-08-20T18:45:41.819001774Z","published":"2026-08-20T18:34:11Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-20T18:34:11Z","nvd_published_at":null,"cwe_ids":["CWE-362","CWE-416"]},"references":[{"type":"WEB","url":"https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-mc9m-6fm9-pghc"},{"type":"PACKAGE","url":"https://github.com/KittyCAD/modeling-app"}],"affected":[{"package":{"name":"zoo-kcl","ecosystem":"PyPI","purl":"pkg:pypi/zoo-kcl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.153"}]}],"versions":["0.3.135","0.3.136","0.3.137","0.3.138","0.3.139","0.3.140","0.3.141","0.3.142","0.3.143","0.3.144","0.3.145","0.3.146","0.3.147","0.3.148","0.3.150","0.3.151","0.3.152"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mc9m-6fm9-pghc/GHSA-mc9m-6fm9-pghc.json"}},{"package":{"name":"kcl-lib","ecosystem":"crates.io","purl":"pkg:cargo/kcl-lib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.153"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mc9m-6fm9-pghc/GHSA-mc9m-6fm9-pghc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}