Out-of-Bounds Memory Read in zstd-jni by Luben Technologies

CVE-2026-87795

What is CVE-2026-87795?

The zstd-jni library, prior to version 1.5.7-14, contains a vulnerability that arises from improper validation of offset and length parameters in the ZstdDictCompress constructor. This flaw allows attackers to manipulate these parameters, potentially leading to out-of-bounds memory reads. When exploited, it can read arbitrary data from the native heap memory, resulting in unintentional information leakage and causing stability issues such as JVM crashes. Users of affected versions are advised to upgrade to the latest version to mitigate this vulnerability.

References