The vulnerability in zstd-jni versions prior to 1.5.7-14 involves failure to check the closed state in the setDict, setLongMax, setLevel, and setRefMultipleDDicts methods of stream classes. Attackers can exploit this by calling these methods on streams that have already been closed, resulting in use-after-free conditions. This leads to memory corruption through writes to freed native pointers, which can corrupt unrelated objects or crash the JVM process. The vulnerability is local attack vector with low complexity and no required privileges or user interaction, but it has high impact on confidentiality and availability due to potential JVM crashes or memory corruption.

Successful exploitation can cause memory corruption and JVM crashes, impacting the availability and integrity of applications using the vulnerable zstd-jni versions. There is no indication of remote exploitation or privilege escalation. The vulnerability is exploitable locally and can cause denial of service or unpredictable behavior in affected applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using vulnerable versions or restrict access to environments where zstd-jni is used to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.