CVE-2026-87824
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-125
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- luben zstd-jni
Weakness type
Related vulnerabilities
- CVE-2026-87875 — Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
- CVE-2026-22590 — Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage
- CVE-2026-73324 — VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Read via Unterminated RealRTSP Response Line
- CVE-2026-87795 — zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
- CVE-2026-87736 — An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC...
- CVE-2026-81646 — Out-of-bounds read vulnerability in the graphics module....
- CVE-2026-49314 — OOB write vulnerability in the rendering and composition module....
- CVE-2026-87602 — Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote...