Out-of-Bounds Read Vulnerability in zstd-jni by Luben

CVE-2026-90560

What is CVE-2026-90560?

The zstd-jni library, specifically versions 1.2.0 through 1.5.7-13, is susceptible to an out-of-bounds read vulnerability due to a lack of validation for offset and length parameters in the ZstdDictDecompress constructor. This oversight allows attackers to manipulate input values, potentially leading to memory access beyond the intended bounds of the array. Such exploitation could cause the Java Virtual Machine to terminate unexpectedly, posing a significant threat to applications using this library.

References