Use-After-Free Vulnerability in zstd-jni Affects Compression and Decompression Dictionaries

CVE-2026-87825

What is CVE-2026-87825?

The zstd-jni library suffers from a use-after-free vulnerability that affects the handling of compression and decompression dictionaries. In versions prior to 1.5.7-14, streams and contexts maintain a shared lock on a dictionary only during the load call. This allows malicious actors to close a dictionary while it is still referenced by a stream or context. Such an action can lead to actions that read or write from freed native memory, resulting in silent data corruption or crashes in the Java Virtual Machine (JVM). To mitigate this vulnerability, it is crucial for users to update to version 1.5.7-14, where the handling of dictionary locks has been improved.

References