CVE-2026-87823

A flaw was found in zstd-jni. This vulnerability arises from insufficient bounds checks in direct-ByteBuffer frame-size native methods, which allows attackers to provide negative or overflowing offsets. A remote attacker can exploit this by supplying specially crafted negative offset values, leading to out-of-bounds memory reads. This can result in the termination of the Java Virtual Machine (JVM), causing a Denial of Service (DoS), or the disclosure of sensitive information by extracting arbitrary frame size data from unintended memory locations.

An out-of-bounds read flaw was found in zstd-jni. Versions before 1.5.7-14 perform insufficient bounds validation in direct ByteBuffer frame-size native methods. An attacker who can provide crafted input with negative or overflowing offsets may cause the JVM to terminate or disclose data from unintended memory locations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Update zstd-jni to version 1.5.7-14 or later. If an update is not immediately possible, do not pass attacker-controlled buffers or offsets to the affected frame-size methods. Validate offsets and lengths before invoking zstd-jni native methods.