CVE-2026-87795
highzstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads.
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
CVSS
8.2
8.2 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-09 10:22
Modified: 2026-09-14 13:19
NVD status: Awaiting Analysis
Last synced 2 days ago
Verified against the source API 2026-10-27 06:52 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/luben/zstd-jni disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdD... disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-vi... disclosure@vulncheck.com
- https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:52 UTC · record ↗