Buffer Overflow Vulnerability in snappy-java by Xerial

CVE-2026-93451

What is CVE-2026-93451?

The snappy-java library, up to version 1.1.10.8, exhibits a buffer overflow vulnerability in its typed Snappy.uncompress*Array methods. This issue arises when the library allocates output arrays based on the uncompressed length divided by the element size but incorrectly passes the raw uncompressed length to the native code. Malicious actors can leverage this vulnerability to manipulate compressed input, leading to misaligned length values and enabling writes beyond allocated array bounds. This opens the door to potential heap memory corruption as attackers can inject their own bytes into the overflowed memory regions.

References