CVE-2026-87795 in zstd-jni
Summary
by MITRE • 09/09/2026
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in zstd-jni versions prior to 1.5.7-14 represents a critical failure in input validation within the Java Native Interface layer of the library. Specifically, the ZstdDictCompress constructor fails to adequately validate the offset and length parameters provided by calling code before passing them to native C functions responsible for dictionary compression operations. This lack of boundary checking creates a direct pathway for out-of-bounds memory reads, as the underlying native implementation trusts these values without verifying that they remain within the allocated bounds of the input buffer or heap memory regions. The flaw stems from an insufficient check on array indices and size constraints during the initialization phase of dictionary compression contexts, allowing maliciously crafted inputs to bypass standard safety mechanisms inherent in higher-level Java abstractions.
From a technical perspective, this vulnerability exploits the trust boundary between managed Java code and unmanaged native C++ code. When an attacker supplies arbitrary offset or length values, they can instruct the native layer to read memory locations that are not part of the intended data structure. This typically results in reading sensitive information from adjacent heap allocations or uninitialized memory regions into the compression dictionary buffer. The immediate operational impact is often a Java Virtual Machine crash due to segmentation faults or access violations triggered by invalid memory accesses. However, beyond denial-of-service conditions, such out-of-bounds reads can potentially lead to information disclosure if the attacker can control subsequent operations that utilize the corrupted data, although the primary manifestation in this context is stability disruption through application termination.
This vulnerability aligns with Common Weakness Enumeration category CWE-125, which describes Out-of-Bounds Read vulnerabilities where software allows reading past the end of a buffer or array. In terms of adversarial tactics, it relates to ATT&CK technique T1083, File and Directory Discovery, as successful exploitation could theoretically allow an attacker to probe memory contents for sensitive data such as cryptographic keys, session tokens, or other confidential information stored in adjacent heap segments. The severity is heightened by the fact that zstd-jni is frequently used in high-throughput environments where performance optimizations may have inadvertently sacrificed rigorous input validation checks during development cycles.
Mitigation strategies primarily involve upgrading to version 1.5.7-14 or later of zstd-jni, which includes patches for proper boundary checking and parameter validation within the ZstdDictCompress constructor. Developers relying on this library should ensure that their build pipelines enforce strict dependency updates to mitigate exposure. For applications where immediate patching is not feasible, implementing defensive programming practices at the Java layer can provide a temporary buffer against exploitation. This involves validating all offset and length parameters before they are passed to native methods, ensuring they do not exceed array bounds or allocated memory sizes. Additionally, enabling JVM security managers and restricting native library access in highly sensitive environments can reduce the attack surface by limiting the potential impact of any successful out-of-bounds read attempts.