CVE-2026-87795: zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zstd-jnito a version that resolves this vulnerability.Fixed in 1.5.7-14
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using zstd-jni before 1.5.7-14 are exposed if untrusted input can control the offset or length passed to the ZstdDictCompress constructor.
What does an attacker need to exploit it?
An attacker needs a way to supply untrusted offset or length values to ZstdDictCompress. No privileges or user interaction are indicated by the provided severity vector.
What is the likely impact of successful exploitation?
The invalid parameters can cause native heap memory to be read into the compression dictionary. This typically causes JVM crashes; confidentiality impact is rated low and availability impact high.
How can I determine whether my deployment is affected?
Check the zstd-jni version in use and review calls to ZstdDictCompress for offset or length values derived from untrusted input. Versions before 1.5.7-14 are affected.
What should be done if the application cannot be updated immediately?
Prevent untrusted input from controlling the offset and length supplied to ZstdDictCompress, and validate those values before constructing the dictionary.