CVE-2026-90560CWE-125

CVE-2026-90560

High · published September 12, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00619 · 49.0th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-09-12T22:16Z
References (8)
https://github.com/luben/zstd-jni · [email protected]https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37 · [email protected]https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49 · [email protected]https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f · [email protected]https://github.com/luben/zstd-jni/issues/405 · [email protected]https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 · [email protected]https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress · [email protected]https://github.com/luben/zstd-jni/issues/405 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 12 SEP 18:06Z
    zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
    cvelistv5