Out-of-Bounds Memory Read Vulnerability in zstd-jni by Luben

CVE-2026-87823

What is CVE-2026-87823?

The zstd-jni library prior to version 1.5.7-14 contains a vulnerability that allows attackers to perform out-of-bounds memory reads due to improper bounds checking. Specifically, the native methods associated with direct-ByteBuffer frame sizes accept 32-bit signed integer offsets without adequate validation. This oversight permits the use of negative or overflowing offsets, enabling potential data leakage from unmapped memory or leading to JVM crashes. Users are advised to upgrade to version 1.5.7-14 or later to mitigate this risk.

References