CVE-2026-89046 in zstd-jni
Summary
by MITRE • 09/10/2026
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The zstd-jni library serves as a critical bridge between Java applications and the high-performance Zstandard compression algorithm implemented in C. Versions ranging from 1.5.5-6 through 1.5.7-13 contain a significant security flaw within the getFrameContentSize method, which is designed to retrieve the size of uncompressed data contained within a compressed stream without fully decompressing it. This functionality relies on native code execution via Java Native Interface (JNI), where memory management and bounds checking are handled by the underlying C implementation rather than the JVM's automatic garbage collection and safety mechanisms. The vulnerability arises from an insufficient validation of input parameters passed from the Java layer to the native layer, specifically regarding the srcPosition argument which indicates the starting offset within the source byte array for reading frame data.
The core technical flaw involves a failure to validate negative values for the srcPosition parameter before it is processed by the native Zstd parser. In standard Java arrays, accessing an index with a negative value would immediately throw an ArrayIndexOutOfBoundsException or similar runtime error, preventing any further execution. However, because this argument is passed directly to native code without proper sanitization in these specific versions of zstd-jni, the negative integer can be interpreted as a large unsigned positive offset due to type conversion behaviors common in JNI interactions between signed Java integers and C size_t types or similar memory address calculations. This allows an attacker to bypass standard bounds checks that would normally prevent access outside the allocated buffer boundaries.
When this manipulated offset is processed by the native frame-header parser, it results in an out-of-bounds read operation. The Zstd library attempts to parse headers from a location in memory that lies before the actual start of the provided byte array or potentially into adjacent heap regions depending on how the pointer arithmetic resolves with negative values. This unauthorized memory access can lead to two primary adverse outcomes: information disclosure and denial of service. In an information disclosure scenario, the application may inadvertently expose sensitive data residing in memory locations immediately preceding the target buffer, such as other objects' fields or internal JVM structures. Alternatively, if the out-of-bounds read accesses unmapped memory pages or corrupts critical state variables during parsing, it triggers a segmentation fault within the native code, which typically results in an immediate crash of the Java Virtual Machine process hosting the application.
From a classification perspective, this vulnerability aligns with CWE-125, Out-of-bounds Read, as it involves reading data beyond the intended boundary of a buffer. It also relates to CWE-20, Improper Input Validation, because the root cause is the failure to properly validate and constrain user-supplied input before processing. In terms of attack vectors, this flaw can be exploited remotely if the zstd-jni library is used in network-facing services that accept compressed data from untrusted sources, such as web servers handling API requests or file upload endpoints. This maps to MITRE ATT&CK technique T1083, File and Directory Discovery, if the information disclosure is leveraged for reconnaissance, or more broadly to initial exploitation techniques involving memory corruption leading to service disruption under T1499, Endpoint Denial of Service.
The operational impact varies based on the context in which the library is deployed. For internal tools processing trusted data, the risk may be limited to application instability and downtime due to JVM crashes. However, for public-facing services or systems handling untrusted input, the vulnerability poses a severe security risk. Attackers can craft maliciously sized compressed streams with specific negative offset parameters to trigger these conditions repeatedly, causing sustained denial of service against critical infrastructure. Furthermore, in environments where memory layout is predictable or side-channel attacks are feasible, the information disclosure aspect could be exploited to leak cryptographic keys, session tokens, or other sensitive payloads stored in adjacent heap memory regions.
Mitigation strategies primarily involve updating the zstd-jni library to a version that includes proper input validation for native method arguments. Developers should ensure they are using versions released after 1.5.7-13 where this specific bounds checking issue has been addressed by validating that offset parameters are non-negative and within valid array limits before passing them to JNI calls. In the interim, if updating is not immediately feasible, application-level defenses can be implemented by wrapping any calls to getFrameContentSize with explicit checks for negative values or ensuring that input data streams do not allow manipulation of internal position pointers passed to native methods. Additionally, deploying runtime protection mechanisms such as memory-safe wrappers or using alternative compression libraries that enforce stricter type safety at the JNI boundary can reduce exposure until a permanent patch is applied.