CVE-2026-87795

zstd-jni, the widely used Java JNI binding for the Zstandard compression library, does not validate the offset and length parameters passed to its ZstdDictCompress constructor in versions before 1.5.7-14, resulting in an out-of-bounds read of native heap memory (CWE-125). The flaw is triggered when an application supplies untrusted, attacker-controlled offset or length values to that constructor; the library then reads memory beyond the intended buffer into the compression dictionary. The primary consequence, per the CVSS 4.0 score of 8.8, is high availability impact from JVM crashes, with a lower confidentiality impact since out-of-bounds native heap bytes can be folded into compressed output. Any Java application or platform embedding an affected zstd-jni version and exposing dictionary parameters to untrusted input is affected; the library's footprint is large because it ships inside major JVM data infrastructure, but direct exploitability depends on the application's usage of dictionary-based compression. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade zstd-jni to version 1.5.7-14 or later, which validates the offset and length parameters in ZstdDictCompress. In the meantime, validate or bound any user-supplied offset/length values before passing them to the constructor, and audit your dependency tree (Maven coordinates com.github.luben:zstd-jni) to identify applications that build compression dictionaries from untrusted input.