CVE-2026-87877VulnerabilityPublished 09/09/2026

CVE-2026-87877: Use After Free in luben zstd-jni

Affects luben zstd-jniSource CVE Database V5

Not known to be exploited · CVSS 7.0 High · fixed in 1.5.7 : patch luben zstd-jni soon.

Data as of 10/24/2026, 22:16:05 UTC

CVSS 4.0 base score

7.0High

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.5.7

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Local
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: High
Vulnerable system availability: High
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the vulnerable system. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the vulnerable system.
Vulnerable system availability: High: There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

What to do

Affected software

Product	Affected	Fixed in
lubenzstd-jni	Affected >=1.3.8-4 <1.5.7-14	Fixed in 1.5.7-14
Mavenluben/zstd-jni`pkg:maven/luben/zstd-jni`Other threats	Affected >=1.3.8-4 <1.5.7-14	Fixed in 1.5.7-14

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fixed version is available starting from 1.5.7-14. Users should upgrade to version 1.5.7-14 or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the affected version range indicating fixed versions at 1.5.7-14 and later.

Description

CVE-2026-87877 is a use-after-free vulnerability in the luben zstd-jni library affecting versions from 1.3.8-4 up to but not including 1.5.7-14. The flaw arises because certain stream class methods do not validate the closed state before operating, allowing attackers to invoke these methods on closed streams. This can lead to writing through freed native pointers, potentially corrupting unrelated objects or causing the Java Virtual Machine (JVM) to crash. The vulnerability has a high severity score of 7.0 and does not currently have known exploits in the wild.

Impact

Successful exploitation can cause memory corruption or JVM crashes due to use-after-free conditions. This impacts the integrity and availability of applications using the affected zstd-jni versions. There is no indication of remote exploitation or privilege escalation. No known active exploits have been reported.

Summary

The vulnerability in zstd-jni versions >=1.3.8-4 and <1.5.7-14 involves failure to check if a stream is closed before executing methods such as setDict, setLongMax, setLevel, and setRefMultipleDDicts. This improper validation enables attackers to perform use-after-free operations by calling these methods on streams that have already been closed, resulting in writes through freed native pointers. The consequence can be memory corruption affecting unrelated objects or JVM crashes. The CVSS 4.0 score is 7.0 (high), with attack vector local, low attack complexity, no privileges or user interaction required, and high impact on integrity and availability.

References

Community reviews

Loading reviews…