CVE-2026-108104: Double Free in xerial snappy-java

CVE-2026-108104 describes a double free vulnerability in the xerial snappy-java library affecting versions >=1.1.7.4 and <1.1.10.10. The issue arises in the SnappyFramedInputStream component, which returns pooled buffers twice if replacement allocation fails. An attacker can exploit this by supplying framed data with a large declared chunk length, triggering an OutOfMemoryError. This error condition can cause shared backing arrays to be exposed or overwritten, potentially leaking or corrupting decompressed data from other streams.

The vulnerability can cause an OutOfMemoryError leading to exposure or overwriting of decompressed data from other streams due to shared backing arrays. This may result in data leakage or data corruption within applications using the affected library versions. There is no indication of remote code execution or privilege escalation. No known exploits are reported in the wild.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, avoid processing untrusted framed data with large chunk lengths or consider upgrading to a version later than 1.1.10.10 once available.