CVE-2026-93452: snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using snappy-java through 1.1.10.8 are exposed when they call Snappy.compress(ByteBuffer, ByteBuffer) with a destination ByteBuffer whose remaining capacity can be smaller than the compressed output.
What does an attacker need to trigger the issue?
An attacker needs to cause the application to compress incompressible input that exceeds the remaining capacity of the destination buffer. No authentication or user interaction is required according to the supplied severity vector.
What is the operational impact of successful exploitation?
The overflow can corrupt off-heap memory and terminate the JVM, resulting in a denial of service.
How can I identify potentially affected code?
Check for deployments of snappy-java through 1.1.10.8 and review calls to Snappy.compress(ByteBuffer, ByteBuffer). Calls are potentially affected when destination-buffer capacity is not sufficient for the resulting compressed data.