# CVE-2026-90560

## Summary

- **CVE ID:** CVE-2026-90560
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-125
- **Published:** Sep 12, 2026
- **Last Modified:** Sep 14, 2026

## Description

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

## Affected Products

- luben — zstd-jni (1.2.0)

## References

- [CNA](https://github.com/luben/zstd-jni/issues/405)
- [CNA](https://github.com/luben/zstd-jni)
- [CNA](https://github.com/luben/zstd-jni/commit/b74ab242d640c40897e62aab4c744ddfad1f915f)
- [CNA](https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L49)
- [CNA](https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14)
- [CNA](https://github.com/luben/zstd-jni/blob/v1.2.0/src/main/java/com/github/luben/zstd/ZstdDictDecompress.java#L37)
- [CNA](https://www.vulncheck.com/advisories/zstd-jni-1.2.0-through-1.5.7-13-out-of-bounds-read-via-zstddictdecompress)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.34%
- **EPSS Percentile:** 26.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._