Out-of-Bounds Read Vulnerability in zstd-jni Product by luben

CVE-2026-89046

What is CVE-2026-89046?

In zstd-jni versions 1.5.5-6 through 1.5.7-13, an out-of-bounds read vulnerability exists due to improper validation of negative source position arguments within the Zstd.getFrameContentSize function. This flaw enables attackers to input negative offset values, bypassing critical bounds checks, leading to memory reads from unauthorized locations. Such behavior could result in unintended information disclosure or crashes of the Java Virtual Machine (JVM), increasing the risk of exploitation in affected applications.

References