The vulnerability in zstd-jni versions prior to 1.5.7-14 involves improper validation of the samples buffer capacity in the Zstd.trainFromBufferDirect native method. By providing crafted sample length arrays with oversized values, an attacker can cause out-of-bounds memory access. This results in the native implementation reading past the buffer allocation, leading to JVM termination. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on availability.

Successful exploitation causes out-of-bounds memory reads in the native code, leading to JVM crashes and denial of service. There is no indication of code execution or data corruption beyond memory read and process termination. The impact is therefore primarily denial of service affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, avoid using vulnerable versions or restrict access to the vulnerable functionality if possible.