Use-After-Free Vulnerability in zstd-jni Affecting Java Virtual Machine
CVE-2026-87877

7HIGH

Key Information:

Vendor

Luben

Status
Zstd-jni
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87877?

The zstd-jni library prior to version 1.5.7-14 is susceptible to a use-after-free vulnerability due to insufficient validation of closed state in several methods, including setDict and setLevel. This flaw allows attackers to invoke these methods on streams that have already been closed, leading to the potential for writing through freed native pointers. Such actions could corrupt unrelated memory objects or even crash the Java Virtual Machine (JVM), posing significant security risks for applications that depend on zstd-jni.

Affected Version(s)

zstd-jni 1.3.8-4 < 1.5.7-14

References

https://github.com/luben/zstd-jni/security/advisories/GHS...
vendor-advisory
https://github.com/luben/zstd-jni/commit/f38f9a1563113d96...
patch
https://github.com/luben/zstd-jni/commit/393d7311766abbc2...
patch

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.