CVE-2026-87877: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zstd-jnito a version that resolves this vulnerability.Fixed in 1.5.7-14
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to invoke zstd-jni stream methods within the affected JVM process. The vulnerability has no required privileges or user interaction, but the attack vector is local.
What application behavior is required to trigger it?
A stream must first be closed, after which setDict, setLongMax, setLevel, or setRefMultipleDDicts is called on that same closed stream. These calls can write through freed native pointers.
Are default deployments affected?
The provided information does not identify any configuration prerequisite. Affected zstd-jni versions are vulnerable when application code calls the listed setters after close().
What can be done before upgrading?
Prevent calls to setDict, setLongMax, setLevel, and setRefMultipleDDicts after a stream has been closed. Ensure stream lifecycle handling prevents closed stream instances from being reused.
How can I determine whether an application is affected?
Check whether it uses zstd-jni earlier than 1.5.7-14 and whether its code can call the affected setter methods on closed stream objects. Crashes of the JVM may also result from triggering the condition.