The vulnerability originates in Buffa’s OwnedView type, where the constructor transmuted a borrowed slice to a static reference and the Deref implementation promoted that static lifetime. The result is that a caller can hold references, such as to a string or byte slice, that outlive the OwnedView object. When the OwnedView is dropped, its backing buffer is freed, and the retained references become dangling. This use‑after‑free allows an attacker to corrupt memory, read data that was once in the heap, and cause cross‑thread misuse, thereby compromising integrity and confidentiality of otherwise safe Rust code.

All releases of Buffa prior to version 0.7.0 contain the flaw. Buffa is a pure‑Rust Protocol Buffers implementation published by Anthropics. Updating to v0.7.0 or later removes the problematic lifetime promotion and prevents the garbage references from being retained.

The CVSS score of 5.9 indicates medium severity. The EPSS score is less than 1%, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is local exploitation in applications or services that load or parse untrusted protobuf data via the vulnerable library. An attacker would need to supply crafted input to the OwnedView constructor or otherwise cause the library to drop an OwnedView while references remain in scope. The defect does not provide a direct remote code execution path, but it enables memory corruption that could be leveraged by a sophisticated attacker in a hostile environment.