Out-of-Bounds Memory Access in zstd-jni by Luben

CVE-2026-87824

What is CVE-2026-87824?

The zstd-jni library prior to version 1.5.7-14 contains a vulnerability where the samples buffer capacity is not validated in the Zstd.trainFromBufferDirect method. This flaw allows attackers to supply oversized sample lengths, which can lead to out-of-bounds memory access. By providing maliciously crafted sample length arrays, an attacker may cause the native implementation to exceed the allocated buffer boundaries, ultimately leading to a termination of the Java Virtual Machine (JVM). It is crucial for users of zstd-jni to update to the latest version to mitigate this risk.

References