CVE-2026-87824: Out-of-bounds Read in luben zstd-jni
Affects luben zstd-jniSource CVE Database V5
Not known to be exploited · CVSS 8.7 High : patch luben zstd-jni soon.
Data as of 10/24/2026, 17:08:27 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| lubenzstd-jni | Affected
| Fixed in
|
Mavenluben/zstd-jnipkg:maven/luben/zstd-jniOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in zstd-jni version 1.5.7-14 and later. Users should upgrade to version 1.5.7-14 or newer to remediate this vulnerability. No other mitigation or workaround is indicated.
Description
CVE-2026-87824 is a high-severity vulnerability in the luben zstd-jni library before version 1.5.7-14. It involves an out-of-bounds read due to improper validation of the samples buffer capacity in the Zstd.trainFromBufferDirect function. Attackers can supply crafted sample length arrays that cause the native code to read beyond allocated buffer boundaries, potentially causing JVM termination.
Impact
Successful exploitation results in out-of-bounds memory reads that cause the Java Virtual Machine to terminate unexpectedly, leading to denial of service. There is no indication of code execution or data disclosure beyond JVM termination. The impact is primarily on availability.
Summary
The vulnerability in zstd-jni versions >=1.3.3-1 and <1.5.7-14 arises from a failure to validate the capacity of the samples buffer in the native method Zstd.trainFromBufferDirect. This allows an attacker to provide oversized per-sample lengths, leading to out-of-bounds memory reads. The native implementation may walk past the buffer allocation, resulting in JVM termination. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability.
References
- github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h (opens in a new tab)
- github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853 (opens in a new tab)
- github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c (opens in a new tab)
- github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java (opens in a new tab)
- github.com/luben/zstd-jni/releases/tag/v1.5.7-14 (opens in a new tab)
- github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980 (opens in a new tab)
- github.com/luben/zstd-jni (opens in a new tab)
- vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect (opens in a new tab)