VDB
CVE-2026-87823
CVE-2026-87823
PUBLISHED
CVSS 8.8 HIGH
Reported by VulnCheck · Published September 9, 2026
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Risk Scores
CVSS 4.0
8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| luben | zstd-jni | 1.1.1 |
| luben | zstd-jni | 1.1.1 |
Timeline
- Sep 9, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 10, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q) vendor-advisory
- Fix commit: reject negative offset and size in the three direct-ByteBuffer natives patch
- Unchecked 32-bit bounds tests at v1.5.7-13 technical-description
- Native declarations with no Java-side validation at v1.5.7-13 technical-description
- zstd-jni v1.5.7-14 Release Notes release-notes
- Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1) technical-descriptionpatch
- product
- VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods third-party-advisory