CVE-2026-87824: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to control to trigger the issue?
An attacker must be able to supply crafted sample-length arrays to Zstd.trainFromBufferDirect. The per-sample lengths must be oversized so that the native implementation reads beyond the samples buffer allocation.
What is the practical impact of successful exploitation?
The out-of-bounds access can cause JVM termination, resulting in a denial of service. The provided data does not describe confidentiality or integrity impact.
Which versions need remediation?
zstd-jni versions 1.3.3-1 through 1.5.7-13 are affected. Versions before 1.5.7-14 fail to validate the samples buffer capacity in the affected method.