CVE-2026-87795CWE-125

CVE-2026-87795

High · published September 9, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00633 · 49.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-09-09T14:22Z
References (9)
https://github.com/luben/zstd-jni · [email protected]https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictCompress.java · [email protected]https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_fast_zstd.c · [email protected]https://github.com/luben/zstd-jni/commit/0d64de4dee6606ff506be36c7f2e714ad0c80fdb · [email protected]https://github.com/luben/zstd-jni/commit/1c4e5a6c3ce8458095225d987d669e6a0937734a · [email protected]https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 · [email protected]https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm · [email protected]https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictcompress · [email protected]https://github.com/luben/zstd-jni/security/advisories/GHSA-ff36-7w3w-g8rm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 10:07Z
    zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
    cvelistv5