CVE-2026-93451: snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
Affected Software
Event History
Frequently Asked Questions
Which application paths are exposed to this issue?
Applications using snappy-java through 1.1.10.8 are exposed when they call typed Snappy.uncompress*Array methods on compressed data controlled by an attacker. The vulnerable behavior is in output-array allocation and the length passed to native code.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network attack access with low complexity, no privileges required, and no user interaction required.
What can successful exploitation affect?
Misaligned uncompressed-length values can cause native code to write attacker-controlled bytes beyond the allocated array bounds, corrupting heap memory. The reported impact includes integrity and availability effects, with no reported confidentiality impact.