CVE-2026-89046: zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
Affected Software
Event History
Frequently Asked Questions
What application condition makes exploitation possible?
An attacker must be able to cause the application to call Zstd.getFrameContentSize with a negative srcPosition value. The negative offset bypasses bounds checks and reaches the native frame-header parser.
How can teams assess whether their application is exposed?
Review uses of Zstd.getFrameContentSize to determine whether srcPosition can be influenced by attacker-controlled input and become negative. Systems using zstd-jni versions 1.5.5-6 through 1.5.7-13 should be evaluated.
What are the likely effects of successful exploitation?
The out-of-bounds read can disclose memory contents or cause the JVM to crash. The available information does not describe an integrity impact.