CVE-2026-87823: Integer Overflow or Wraparound in luben zstd-jni
Affects luben zstd-jniSource CVE Database V5
Not known to be exploited · CVSS 8.8 High : patch luben zstd-jni soon.
Data as of 10/24/2026, 17:08:27 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 36% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| lubenzstd-jni | Affected
| Fixed in
|
Mavenluben/zstd-jnipkg:maven/luben/zstd-jniOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in zstd-jni version 1.5.7-14. Users should upgrade to version 1.5.7-14 or later to remediate this vulnerability. No additional mitigations are specified.
Description
CVE-2026-87823 is an integer overflow or wraparound vulnerability in the zstd-jni library before version 1.5.7-14. It arises from 32-bit signed bounds checks on certain native methods, allowing attackers to supply negative or overflowing offsets. This can cause out-of-bounds memory reads, potentially leading to JVM crashes or unauthorized reading of arbitrary memory data. The vulnerability has a high severity score of 8.8 and affects versions from 1.1.1 up to but not including 1.5.7-14.
Impact
Successful exploitation can cause the Java Virtual Machine to crash or allow attackers to read arbitrary memory data without authorization. This can disrupt application availability and potentially expose sensitive information from memory.
References
- github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q (opens in a new tab)
- github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f (opens in a new tab)
- github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c (opens in a new tab)
- github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java (opens in a new tab)
- github.com/luben/zstd-jni/releases/tag/v1.5.7-14 (opens in a new tab)
- github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac (opens in a new tab)
- github.com/luben/zstd-jni (opens in a new tab)
- vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods (opens in a new tab)