CVE-2026-87823
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.43%
- CWE
- CWE-190
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- luben zstd-jni
Weakness type
Related vulnerabilities
- CVE-2026-89158 — PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant...
- CVE-2026-89157 — PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an...
- CVE-2026-88914 — Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
- CVE-2026-16174 — Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
- CVE-2026-88035 — Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
- CVE-2026-85228 — Integer overflow in tensor buffer validation in Deep Java Library
- CVE-2026-88015 — rclone local: crafted Range request against a translated symlink panics (DoS)
- CVE-2026-56711 — VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation