{"id":"GHSA-mc9m-6fm9-pghc","aliases":[],"url":"https://o3.security/vulnerability/GHSA-mc9m-6fm9-pghc","summary":"Zoo Design Studio: Memory-corruption in memory handling of lib-kcl","details":"A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.","published":"2026-08-20T18:34:11Z","modified":"2026-08-20T18:45:13.443181606Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"kcl-lib","fixedVersion":"0.2.153"},{"ecosystem":"PyPI","name":"zoo-kcl","fixedVersion":"0.3.153"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-mc9m-6fm9-pghc"},{"type":"PACKAGE","url":"https://github.com/KittyCAD/modeling-app"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T18:45:13.443181606Z"}}