CVE-2026-87823: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed in practice?
Applications using zstd-jni versions 1.1.1 through 1.5.7-13 are exposed if an attacker can influence the offset supplied to one of the three direct-ByteBuffer frame-size native methods. The issue is reachable remotely only when attacker-controlled input can reach those method calls.
What input is required to trigger the issue?
An attacker needs to supply a negative offset, particularly a value near Integer.MIN_VALUE, to a vulnerable direct-ByteBuffer frame-size method. The flawed 32-bit signed bounds check can then allow an out-of-bounds native memory read.
What is the available fix?
Upgrade zstd-jni to version 1.5.7-14 or later. Versions before 1.5.7-14 are affected according to the provided information.
What can be done if an upgrade cannot happen immediately?
Prevent untrusted input from controlling offsets passed to the affected direct-ByteBuffer frame-size methods. Reject negative offsets and ensure offset and length validation cannot overflow before invoking the native methods.