CVE-2026-90559CWE-787

CVE-2026-90559

High · published September 12, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00630 · 49.5th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-09-12T22:16Z
References (4)
https://github.com/xerial/snappy-java · [email protected]https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L561 · [email protected]https://github.com/xerial/snappy-java/issues/728 · [email protected]https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-out-of-bounds-write-via-uncompress · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 12 SEP 18:06Z
    snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
    cvelistv5